HQ Trivia (Unreleased) - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application HQ Trivia Unreleased published at the 'play' market has multiple vulnerabilities...

Moodle Cross-Site Request Forgery Vulnerability (CNVD-2018-02378)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. filepicker is one of the file selectors. A cross-site request forgery vulnerability...

Threat Outbreak Alert RuleID31781: Email Messages Distributing Malicious Software on January 22, 2018

Medium Alert ID: 56512 First Published: 2018 January 22 17:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31781 may contain the following files: Name |...

Juniper Junos Remote Code Execution Vulnerability

Juniper Junos OS is a Juniper Networks network operating system designed for the company's hardware systems. The OS provides a secure programming interface and the Junos SDK. A remote code execution vulnerability exists in Juniper Junos OS. A remote attacker could exploit the vulnerability to...

IBM Security Access Manager Open Redirect Vulnerability

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. An open redirection vulnerability exists in IBM Security Access Manager. A remote...

rails_admin rails gem XSS vulnerability

Summary An exploitable XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim’s browser. An attacker can phish an...

Web Application Spider: BlackWidow

BlackWidow is a python based web application spider to gather subdomains, URL’s, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL’s for common OWASP vulnerabilities. Features: Automatically collect all URL’...

Threat Outbreak Alert RuleID31715: Email Messages Distributing Malicious Software on January 8, 2018

Medium Alert ID: 56420 First Published: 2018 January 8 16:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31715 may contain the following files: Name |...

Threat Outbreak Alert RuleID31714: Email Messages Distributing Malicious Software on January 8, 2018

Medium Alert ID: 56419 First Published: 2018 January 8 15:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31714 may contain the following files: Name |...

MGASA-2018-0042 Updated fossil packages fix security vulnerability

Client-side code execution via crafted "ssh://" URLs CVE-2017-17459...

Updated fossil packages fix security vulnerability

Client-side code execution via crafted "ssh://" URLs CVE-2017-17459...

Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...

Dojo by BullGuard - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Dojo by BullGuard published at the 'play' market has multiple vulnerabilities...

openSUSE Security Update : global (openSUSE-2017-1420)

This update for global fixes the following issue : - CVE-2017-17531: Argument-injection vulnerability allowed execution of arbitrary code via crafted URLs boo1073197 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Facebook phishers want you to “Connect with Facebook”

As we edge toward Christmas, scammers are throwing their own party—in the form of Facebook phishing pages linked to and from bogus landing pages hosted on sitesdotgoogledotcom URLs. These landing pages, adorned with very large and very fake "Login with Facebook" buttons, may be extra convincing t...

Remote Command Execution (RCE)

github.com/git-lfs/git-lfs is vulnerable to remote code execution RCE attacks. The application does not sanitize ssh:// URLs passed to it, allowing a malicious user to execute arbitrary commands...

GitHub Git LFS Arbitrary Command Execution Vulnerability

GitHub Git LFS is a U.S. GitHub company developed an open source project . GitHub Git LFS for version control of large files in the open source Git extension . An arbitrary command execution vulnerability exists in GitHub Git LFS versions prior to 2.1.1. The vulnerability can be exploited by remo...

CVE-2017-1423

IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476...

Code injection

IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476...

CVE-2017-1423

IBM WebSphere Portal versions 8.5 and 9.0 expose backend server URLs that are configured for the Web Application Bridge component. This vulnerability (CVE-2017-1423) is an information-disclosure flaw triggered by the Web Application Bridge, leading to potential exposure of backend endpoints. It i...