2944 matches found
Mirosoft advises ditching voice, SMS multi-factor authentication
By Deeba Ahmed Microsoft wants users to opt for securer technologies citing multi-factor authentication MFA as the "least secure" method available nowadays. This is a post from HackRead.com Read the original post: Mirosoft advises ditching voice, SMS multi-factor authentication...
EulerOS Virtualization 3.0.6.6 : PyYAML (EulerOS-SA-2020-2475)
According to the versions of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability in the implementation of the Short Message Service SMS handling functionality of Cisco IOS Software and Cisco IOS ...
Wroba Mobile Banking Trojan Spreads to the U.S., via Texts
The Wroba mobile banking trojan has made a major pivot, targeting people in the U.S. for the first time. According to researchers at Kaspersky, a wave of attacks are taking aim at U.S. Android and iPhone users in an effort that started on Thursday. The campaign uses text messages to spread, using...
HPE Intelligent Management Center (iMC) smsrulesdownload Expression Language Injection Remote Code Execution Vulnerability
HPE Intelligent Management Center is a suite of network intelligence management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. A security vulnerability exists in HPE...
A week in security (October 12 – October 18)
Last week on Malwarebytes Labs, we looked at journalism’s role in cybersecurity on our Lock and Code podcast, gave tips for safer shopping on Amazon Prime day, and discussed an APT attack springing into life as Academia returned to the real and virtual campus environment. We also dug into potenti...
Ozeki NG SMS Gateway Arbitrary File Upload (CVE-2020-14022)
An arbitrary file upload vulnerability exists in Ozeki NG SMS Gateway. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Mail.ru: Account TakeOver at kvartira.city-mobil.ru
kvartira.city-mobil.ru had no sufficient protection against SMS code bruteforce...
CVE-2020-13626
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked...
Authorization
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked...
CVE-2020-13626
The CVE-2020-13626 entry concerns OnePlus App Locker (up to 2020-10-06). The vulnerability allows physically proximate attackers to exploit Google Assistant to bypass an authorization check and send an SMS while the SMS app is locked. CVSS data provided: CVSS v3.1: AV=Physical, AC=Low, PR=None, U...
CVE-2020-13626
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked...
CVE-2020-2297
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
CVE-2020-2297
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
Design/Logic Flaw
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
CVE-2020-2297
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...
CVE-2020-2297
The CVE-2020-2297 entry concerns Jenkins SMS Notification Plugin versions 1.2 and earlier, where an access token is stored unencrypted in the global configuration file on the Jenkins controller. The file com.hoiio.jenkins.plugin.SMSNotification.xml can be viewed by users with filesystem access, e...
PT-2020-15527 · Jenkins · Jenkins Sms Notification Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins SMS Notification Plugin versions 1.2 and earlier Description: The issue concerns the storage of an access token in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the file...
Ozeki NG SMS Gateway Directory Traversal (CVE-2020-14028)
A directory traversal vulnerability exists in Ozeki NG SMS Gateway. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server...
sms-advisors.com Cross Site Scripting vulnerability OBB-1385816
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-14030
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating and writing to the disk malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code executi...