CVE-2017-5593

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ 0.16.563.580 -...

CVE-2017-5591

Technical details about CVE-2017-5591 are not publicly provided in the supplied documents. Monitor for updates from vendor advisories and security bulletins.

CVE-2017-5592

Technical details for CVE-2017-5592 are not publicly available in the provided documents. Monitor for updates from Vulners/EUVD sources.

CVE-2017-5593

Technical details about CVE-2017-5593 are not provided in the supplied documents. Monitor for updates from primary sources for affected products and remediation guidance.

CVE-2017-5591

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and...

CVE-2017-5605

Technical details for CVE-2017-5605 are not publicly available in the provided documents; connected EUVD entries do not include product, impact, or remediation information for this CVE. Monitor for updates.

CVE-2017-5858

Technical details for CVE-2017-5858 are not publicly available in the provided documents; no concrete information on affected products, root cause, versions, or fixes is present here. Monitor for updates.

CVE-2017-5604

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for mcabber 1.0.0 - 1.0.4...

The Social-Engineer Toolkit (SET)

The Social-Engineer Toolkit SET is specifically designed to perform advanced attacks against the human element. SET has quickly became a standard tool in a penetration testers arsenal. SET is written by David Kennedy ReL1K and with a lot of help from the community it has incorporated attacks neve...

Wix Remote Email PoC 0day

Wix send remote email affects all pages created with wix.com, possible social engineering attack. Usage Info usage: exploit.py -h -u URL -t EMAILTO -f EMAILFROM -s SUBJECT -i SITEID -m MESSAGE This is private exploit. You can buy it at https://0day.today...

Coinbase: Requestor Email Disclosure via Email Notification

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...

BINOM3 Electric Power Quality Meter (Update A)

CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...

BINOM3 Electric Power Quality Meter

CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...

Phishers unleash simple but effective social engineering techniques using PDF attachments

The Gmail phishing attack is reportedly so effective that it tricks even technical users, but it may be just the tip of the iceberg. We’re seeing similarly simple but clever social engineering tactics using PDF attachments. These deceitful PDF attachments are being used in email phishing attacks...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

Open-Xchange: Information About Your System(Sensitive Directories)

This vulnerability can read your plugins like you are using jQuery Superfish,jsquary easy etc... and emails... Sensitive Directories...for social engineering emails, directories, plugins is so important you should hide this. I share with files you can look file is saying everything...

Slack: Access of Android protected components via embedded intent

@bagipro found a vulnerability wherein a malicious and unprivileged app on the victim's phone could interact with any activity in the Slack Android app, allowing manipulation of the app in unintended ways. Thanks for the finding @bagipro! I found the following code inside com.Slack.ui.HomeActivit...

Microsoft Power Point 2016 - Java Code Execution

Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial : https://www.youtube.com/watch?v=Lih-iuXgEM Youtube Channel...

IC3 Warns of Employment Scams Targeting College Students

The Internet Crime Complaint Center IC3 has issued an alert on employment scams targeting college students. Phony job opportunities are advertised via college employment websites or students’ university emails. Unfortunately, students who take the bait suffer financial losses. US-CERT encourages...

Huawei P9 Plus TP Driver Input Checksum Vulnerability

Huawei P9 Plus is a smartphone product from Huawei, China. An input checksum security vulnerability exists in the touchscreen driver of the Huawei P9 Plus phone. An attacker could trick users into installing a malicious application, and the application could exploit the vulnerability to send...