3154 matches found
German users targeted with Gootkit banker or REvil ransomware
This blog post was authored by Hasherezade and Jérôme Segura On November 23, we received an alert from a partner about a resurgence of Gootkit infections in Germany. Gootkit is a very capable banking Trojan that has been around since 2014 and possesses a number of functionalities such as keystrok...
Wordpress Yoast SEO Plugin Arbitrary File Upload
An arbitrary file upload vulnerability exists in Wordpress Yoast SEO Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
WebNavigator Chromium browser published by search hijackers
A mystery Chromium browser recently made a sudden appearance, and is certainly proving popular. But what is it, and where did it come from? Malwarebytes detects the browser as PUP.Optional.WebNavigator, and we found several clues that this browser was brought to you by a notorious family of searc...
seo-tech.de Improper Access Control vulnerability OBB-1489013
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
How to Run Google SERP API Without Constantly Changing Proxy Servers
You've probably run into a major problem when trying to scrape Google search results. Web scraping tools allow you to extract information from a web page. Companies and coders from across the world use them to download Google's SERP data. And they work well – for a little while. After several...
SEO Panel 4.6.0 Remote Code Execution
Exploit Title: SEO Panel 4.6.0 - Remote Code Execution Google Dork: N/A Date: 2020-10-03 Exploit Author: Kiko Andreu kikoas1995 & Daniel Monzón stark0de Vendor Homepage: https://seopanel.org/ Software Link: https://www.seopanel.org/spdownload/4.6.0 Version: 4.6.0 Tested on: Kali Linux x64 5.4.0 C...
EdgeWorkers Use Story: Creating high-performing, individualized campaign responses in online retail
As campaigns and digital experiences become more individualized, they can create a challenge for delivering content to consumers at the highest velocity. Having each paid search, social media, and email marketing campaign add unique query string parameters to requests is critical for tracking the...
CVE-2020-7739
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
UBUNTU-CVE-2020-7739
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
CVE-2020-7739
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
CVE-2020-7739
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack...
seo-jerusalem.com Cross Site Scripting vulnerability OBB-1378666
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
seo-directories.seo-index.com Cross Site Scripting vulnerability OBB-1312641
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Server-side Request Forgery (SSRF)
Overview phantomjs-seo is an express middleware for prerendering pages with phantomjs for search engine crawling Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing...
jacksonvilleseo.me Cross Site Scripting vulnerability OBB-1280991
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress All in One SEO Pack Plugin < 3.6.2 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aioseo:allinoneseo"; if description...
PHP website background management system SEO special version of Langfang Shanghao Information Network Co., Ltd. suffers from universal password login vulnerability
Langfang Shanghao Information Network Co., Ltd. was established in 2000 by merging Shanghao Advertising Design Company and Shanghao Software Development Company. There is a universal password login vulnerability in the SEO-specific version of Langfang Shanghao Information Network Co., Ltd.'s PHP...
WordPress All In One SEO Pack plugin <= 3.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress All In One SEO Pack plugin versions = 3.6.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 3.6.2...
A week in security (June 8 – 14)
Last week on Malwarebytes Labs, we looked into nasty search hijackers that worried a lot of Chrome users; a list of considerations for MSPs when looking for an RMM platform; the complaint faced by ParetoLogic, the company that issues SpeedyPC, a product that claims to find and remove various PC...
WordPress SEO Plugin Authentication Bypass
An access control weakness exists in the Wordpress SEO Plugin by Rank Math. The vulnerability is due to a lack of authorization verification on the updateMeta REST endpoint...