icann-transfers.info XSS vulnerability

Open Bug Bounty ID: OBB-708131 Description| Value ---|--- Affected Website:| icann-transfers.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Business email compromise scam costs Pathé $21.5 million

Recently released court documents show that European-based cinema chain Pathé lost a small fortune to a business email compromise BEC scam in March 2018. How much? An astonishing US$21.5 million roughly 19 million euros. The attack, which ran for about a month, cost the company 10 percent of its...

Information security: How Hackers Leverage Stolen Data for Profit

Data theft is inarguably big business for hackers. This has been proven time and time again when big-name companies and their customers are involved in a data breach. As these instances appear to take place more often, and the number of stolen or compromised files continues to rise, it's worth...

libssh Authentication Bypass Makes it Trivial to Pwn Rafts of Servers

The libssh open-source project has issued an update to address an authentication bypass vulnerability in the server code — to say that it’s trivial to exploit is an understatement. The flaw CVE-2018-10933 exists in libssh versions 0.6 and above being used in server mode – and it allows anyone to...

Malicious Platform Independent Trojan GPlayed Disguised as Google Play Store

By Waqas Newly discovered Trojan malware, which has been dubbed as GPlayed by the IT security experts at Cisco Talos, disguises itself as Google Play Store to trick users into downloading it. After getting installed, it steals location information and bank details from the device. Additionally, i...

PT-2018-17715 · Mcafee +1 · Mcafee Application/Change Control +1

Name of the Vulnerable Software and Affected Versions: McAfee Application and Change Control MACC versions 8.0.0 Hotfix 4 and earlier Description: The issue allows authenticated users to execute arbitrary code via file transfer from an external system. This is due to a vulnerability in accessing,...

Updated lftp packages fix security vulnerability

Updated lftp packages fix security vulnerability Lftp 4.8.4 bring a security fix for "file:" file names. From version 4.7.7 which was previous MGA6 lftp version, it brings also several new parameters like the -P option for parallel transfers...

CVE-2018-14439

espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts...

CVE-2018-14439

espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts...

Code injection

espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts...

CVE-2018-14439

espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers to trigger currency transfers of unintended amounts...

IC3 Warns of Business Email Compromise Scams

The Internet Crime Complaint Center IC3 has released an alert on business email compromise scams. This type of scam targets businesses and individuals by using social engineering or computer intrusion to compromise legitimate email accounts and conduct unauthorized fund transfers or obtain...

When three isn’t a crowd: Man-in-the-Middle (MitM) attacks explained

Gone are the days when eavesdropping is just the stuff of spies and the town gossip. In fact, it has evolved to become everyone’s favorite pastime. Thanks to the internet, it is exponentially easier now more than ever to idle by and catch juicy information than to press your ear against your...

PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-22 Vulnerability...

PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-21 Vulnerability...

FuturXE has an unspecified vulnerability

FuturXE FXE is an ethereum-based virtual currency. A security vulnerability exists in the 'transferFrom' function of the smart contract implementation in FXE, which stems from a logic error in the program. An attacker could exploit the vulnerability to make an unauthorized transfer of digital...

FBI’s BEC Crackdown Leads To 74 Arrests Globally

The FBI announced Monday the results of a major crackdown on scammers behind business email compromise BEC campaigns that resulted in 74 arrests and the retrieval of millions of dollars. Several U.S. federal authorities and police from other countries were involved in Operation WireWire, a...

Feds Arrest 74 Email Fraudsters Involved in Nigerian BEC Scams

The United States Department of Justice announced Monday the arrest of 74 email fraudsters across three continents in a global crackdown on a large-scale business email compromise BEC scheme. The arrest was the result of a six-month-long operation dubbed "Operation Wire Wire" that involved the US...

CVE-2016-10629

nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

CVE-2016-10615

curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...