UBUNTU-CVE-2020-12415

When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox 78...

CVE-2020-15364

The Nexos theme through 1.7 for WordPress allows top-map/?searchlocation= reflected XSS...

SQL Injection Vulnerability in Website Building System of Chifeng E-top Network Limited (CNVD-2020-41757)

Ltd. is mainly engaged in website construction, website promotion, website planning, software development, network promotion, network integrated marketing and other businesses. There is a SQL injection vulnerability in the website building system of Chifeng E-top Network Co., Ltd, which can be...

SQL Injection Vulnerability in the Website Building System of Chifeng E-top Network Limited (CNVD-2020-41736)

Chifeng ETO Network Co., Ltd. is a service company mainly engaged in website construction and website promotion. There is a SQL injection vulnerability in the website building system of Chifeng E-top Network Co., Ltd, which can be exploited by attackers to obtain sensitive information from the...

SQL Injection Vulnerability in Website Building System of Chifeng E-top Network Co. Ltd (CNVD-2020-41776)

Ltd. is mainly engaged in website construction, website promotion, website planning, software development, network promotion, network integrated marketing and other businesses. There is a SQL injection vulnerability in the website construction system of Chifeng E-top Network Co., Ltd, which can b...

Information leakage vulnerability of website building system of Chifeng E-top Network Co.

Ltd. is mainly engaged in website construction, website promotion, website planning, software development, network promotion, network integrated marketing and other businesses, is a complex service company. There is an information leakage vulnerability in the website building system of Chifeng...

top-law-schools.com Cross Site Scripting vulnerability OBB-1196944

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

USDT has a fake top-up vulnerability

USDT is a token based on P2P transactions. The vulnerability stems from a flaw in the logic used by exchanges to confirm the success of a USDT top-up transaction by not checking the value of the valid field in the transaction details on the blockchain to see if it is true, resulting in a "fake...

SQL Injection Vulnerability in Website Building System of Chifeng E-top Network Co.

Ltd. is mainly engaged in website construction, website promotion, website planning, software development, network promotion, network integrated marketing and other businesses, is a complex service company! Chifeng E-top Network Co., Ltd. website building system exists SQL injection vulnerability...

Congratulating Our Top 2020 Q1 Security Researchers!

Following the second Security Researcher Quarterly Leaderboard and the 2020 MSRC Most Valuable Security Researchers criteria we published in February 2020, we are excited to announce the 2020 First Quarter Q1 Security Researcher Leaderboard, listing our top contributing researchers for the last...

Congratulating Our Top 2020 Q1 Security Researchers!

Following the second Security Researcher Quarterly Leaderboard and the 2020 MSRC Most Valuable Security Researchers criteria we published in February 2020, we are excited to announce the 2020 First Quarter Q1 Security Researcher Leaderboard, listing our top contributing researchers for the last...

procps: Local privilege escalation in top

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of...

Arbitrary Code Execution

top-pegasus is vulnerable to arbitrary code execution. A stack buffer overflow flaw was found in the PAM authentication code in the OpenPegasus CIM management server. An unauthenticated remote user could trigger this flaw and potentially execute arbitrary code with root privileges...

Imperva is a Leader in the Forrester Wave: Web Application Firewalls, Q1

Web application firewalls continue to be a core technology function for securing critical assets, and for IT professionals, market analyst reports and validation are critical when deciding upon new WAF solutions. That’s why we’re proud to share that Imperva Cloud WAF has recently been recognized ...

Convincing Google Impersonation Opens Door to MiTM, Phishing

An attack that uses homographic characters to impersonate domain names and launch convincing but malicious websites takes minutes and a bare modicum of skill — while reaping high rates of success in luring victims, according to an independent researcher. Researcher Avi Lumelsky set out to see how...

yii-china.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1119333 Security Researcher kun-fly Helped patch 667 vulnerabilities Received 7 Coordinated Disclosure badges Received 43 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting yii-china.com website and i...

Rocket Loader skimmer impersonates CloudFlare library in clever scheme

Update: The digital certificate issued for https.ps has been revoked by GlobalSign. Fraudsters are known for using social engineering tricks to dupe their victims, often times by impersonating authority figures to instill trust. In a recent blog post, we noted how criminals behind Magecart skimme...

IoTGoat - A Deliberately Insecure Firmware Based On OpenWrt

The IoTGoat Project is a deliberately insecure firmware based on OpenWrt. The project’s goal is to teach users about the most common vulnerabilities typically found in IoT devices. The vulnerabilities will be based on the IoT Top 10 as documented by OWASP:...

UBUNTU-CVE-2020-9391

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has be...

procps: Local privilege escalation in top

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of...