2945 matches found
Cross site scripting
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...
CVE-2017-18489
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...
CVE-2017-18489
CVE-2017-18489 affects the WordPress plugin Contact Form 7 SMS Addon prior to v2.4.0. The vulnerability is a reflected XSS in the file that prints the GET parameter 'to' (vulnerability in plugins/clockwork-two-factor-authentication/templates/clockwork-test-message.php per PoC). Exploitation targe...
CVE-2017-18495
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS...
CVE-2017-18495
The connected records confirm CVE-2017-18495 affects the Gravity Forms SMS Notifications plugin for WordPress, with a cross-site scripting (XSS) vulnerability in versions prior to 2.4.0. The issue arises from insufficient validation of client-side data, enabling an attacker to execute client-side...
Cerberus: A New Android 'Banking Malware For Rent' Emerges
After a few popular Android Trojans like Anubis, Red Alert 2.0, GM bot, and Exobot, quit their malware-as-a-service businesses, a new player has emerged on the Internet with similar capabilities to fill the gap, offering Android bot rental service to the masses. Dubbed "Cerberus ," the new remote...
A week in security (August 5 – 11)
Last week on Malwarebytes Labs, we explained how brain-machine interface BMI technology could usher in a world of Internet of Thoughts, why having backdoors is problematic, and how we can improve the security of our smart homes. To cap off Hacker Summer Camp week, the Labs team released a special...
The Fully Remote Attack Surface of the iPhone
Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as...
Android Ransomware Spreads Via 'Sex Simulation Game' Links on Reddit, SMS
Researchers are warning of a new Android ransomware being spread via links in online forums and SMS messages. The malicious links purport to connect back to a sex simulation game, but in reality lead to ransomware that encrypts victims’ files. The Android ransomware, dubbed Android/Filecoder.C, h...
Latest FinSpy Modules Lift Data from Secure Messaging Apps
The latest iOS and Android versions of the FinSpy espionage malware have been deployed in the wild, and are capable of collecting a raft of personal information such as contacts, SMS/MMS messages, emails, calendars, GPS location, photos, files in memory, phone call recordings and data – even from...
New FinSpy iOS and Android implants revealed ITW
Updated: 23.07.2019 After publication of this article, we received a letter from a representative of Gamma Group International Ltd. stating that they disposed of all interests in FinFisher FinSpy in 2013. This article has been corrected in accordance with this new information. According to...
The vulnerability of the built-in software of the “Granit-Navigator-6.18” device arises from the absence of a mechanism for authenticating users during device configuration. This allows attackers to read and modify the device’s configuration parameters, thereby enabling system compromise.
The vulnerability of the built-in software of the “Granit-Navigator-6.18” device is due to the absence of a mechanism for authenticating users during device configuration using SMS commands. Exploiting this vulnerability allows a remote attacker to read and modify the device’s configuration...
CVE-2019-7278
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...
CVE-2019-7278
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...
Design/Logic Flaw
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...
CVE-2019-7278
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...
CVE-2019-7278
CVE-2019-7278 affects Optergy Proton/Enterprise Building Management System. Root cause: Exposed Dangerous Method or Function (CWE-749) allowing unauthenticated access to a sensitive function. Impact: cryptic in public docs, but CVSSv3 base score is 7.3 (medium-high) with network access, no user i...
ViceLeaker Operation: mobile espionage targeting Middle East
In May 2018, we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens. Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims; and a hash of the APK involved Android application was tagged in our sample feed for...
Riltok mobile Trojan: A banker with global reach
Riltok is one of numerous families of mobile banking Trojans with standard for such malware functions and distribution methods. Originally intended to target the Russian audience, the banker was later adapted, with minimal modifications, for the European "market." The bulk of its victims more tha...
MobOk Malware Hides in Photo Editors on Google Play, Siphons Cash
A powerful money-siphoning malware known as MobOk has been found hiding in seemingly legitimate photo editing apps available on the Google Play store. The Pink Camera and Pink Camera 2 apps, now removed, had been installed around 10,000 times, according to researchers at Kaspersky. They included...