Unspecified Vulnerability in Apache Guacamole

Apache Guacamole is a clientless remote desktop gateway from the Apache USA Foundation. The product supports protocols such as VNC, RDP and SSH. An information disclosure vulnerability exists in Apache Guacamole 1.2.0 and earlier versions, which stems from the fact that if multiple users share...

Information DIsclosure

mautic/core is vulnerable to information disclosure. The vulnerability exists as the tracking cookies per contact is systematically incremented by their auto-incremented ID, and it is possible to retrieve information about the contact through forms by progressive profiling...

Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID

Impact An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as...

GHSA-VFXJ-QG93-7WWC Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID

Impact An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as...

CVE-2020-23522

creationtimestamp| type| source ---|---|--- 2021-01-19 16:55:59+00:00| seen| https://t.me/cibsecurity/22258 2021-05-31 03:55:03+00:00| seen| https://t.me/pwnwikizhchannel/553 2024-11-14 06:08:14+00:00| seen| MISP/099a7f3f-a9c7-40b7-ba9b-5e5e0a42542e...

Revive Adserver: Open redirect in ck.php and lg.php

An opportunity for open redirects has been available by design since the early versions of Revive Adserver's predecessors in the impression and click tracking scripts to allow third party ad servers to track such metrics when delivering ads. Historically the display advertising industry has...

OpenCATS Cross-Site Scripting Vulnerability (CNVD-2021-09918)

OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A cross-site scripting vulnerability exists in OpenCATS 0.9.5-3 and earlier versions. An...

High-Severity Cisco Flaw Found in CMX Software For Retailers

A high-severity flaw in Cisco’s smart Wi-Fi solution for retailers could allow a remote attacker to alter the password of any account user on affected systems. The vulnerability is part of a number of patches issued by Cisco addressing 67 high-severity CVEs on Wednesday. This included flaws found...

Friday Squid Blogging: Searching for Giant Squid by Collecting Environmental DNA

The idea is to collect and analyze random DNA floating around the ocean, and using that to figure out where the giant squid are. No one is sure if this will actually work. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blo...

Denial Of Service (DoS)

xen is vulnerable to denial of service DoS. The vulnerability exists through when acting upon a guest XSRESETWATCHES request, and not all tracking information is freed, through an unbounded memory usage in oxenstored...

A week in security (December 21- December 27)

Last week on Malwarebytes Labs we warned our readers about not so festive social media scams, how Emotet returned just in time for Christmas, we tried out some free online games your kids are playing and here’s what happened, and our VideoBytes episode talked about what penetration testing tools...

How Your Digital Trails Wind Up in the Police’s Hands

Phone calls. Web searches. Location tracks. Smart speaker requests. They’ve become crucial tools for law enforcement, while users often are unaware...

CVE-2020-17008

creationtimestamp| type| source ---|---|--- 2020-12-24 18:35:13+00:00| seen| https://t.me/xakepru/10193 2020-12-25 14:29:00+00:00| exploited| https://t.me/truesecator/1294 2020-12-26 06:00:14+00:00| seen| https://t.me/haccking/94641 2020-12-26 07:00:11+00:00| seen| https://t.me/haccking/5781...

CVE-2020-35693

On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy BLE device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offer...

Code injection

On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy BLE device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offer...

CVE-2020-28071

creationtimestamp| type| source ---|---|--- 2020-12-23 21:12:58+00:00| seen| https://t.me/cibsecurity/21241 2024-11-14 06:07:42+00:00| seen| MISP/dab271fa-09e2-4c47-b782-e518ae4966c6...

CentOS 7 : kernel (RHSA-2020:5437)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5437 advisory. - The flowdissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs...

CVE-2020-8995

Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools...

CVE-2020-8995

Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools...

Hardcoded credentials

Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools...