CVE-2020-5627

Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

Roundtable video: Disinformation and election security

By Jon Munshaw. In our continued coverage of election security, we decided to sit down with four Talos and Cisco researchers to discuss disinformation. As we outlined in our recent research paper, disinformation is one of the cornerstones of threat actors' efforts to disrupt the American election...

The vulnerability of the Windows Media Foundation component of the Windows operating system allows attackers to gain privileges to install programs, view, modify, or delete data, as well as create new user accounts with full user rights.

The vulnerability of the Windows Media Foundation component in the Windows operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain privileges to install programs, view, modify, or delete data, and create...

apps.telkom.co.za Improper Access Control vulnerability OBB-1315560

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Windows Text Service Module Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability could gain execution on a victim system. An attacker could host a specially crafted website that is designed to exploit the...

PT-2020-4083 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI affected versions not specified Description: The issue is related to errors in handling objects in memory by the Windows Graphics Device Interface GDI. This can allow a remote attacker to execute arbitrary code, potentially giving...

Hackers breach e-commerce websites operated by Warner Music Group

By Zara Khan WMG hasn’t disclosed the number of websites compromised or how the hackers accessed such critical information. This is a post from HackRead.com Read the original post: Hackers breach e-commerce websites operated by Warner Music Group...

Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

GHSA-VV52-3MRP-455M Malicious Package in m-backdoor

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. Recommendation Remove the...

New Web-Based Credit Card Stealer Uses Telegram Messenger to Exfiltrate Data

Cybercriminal groups are constantly evolving to find new ways to pilfer financial information, and the latest trick in their arsenal is to leverage the messaging app Telegram to their benefit. In what's a new tactic adopted by Magecart groups, the encrypted messaging service is being used to send...

UltraRank hackers compromised 100s of websites via JS-Sniffer attacks

By Zara Khan The cybercriminal group dubbed as “UltraRank’ previous shenanigans were linked to Magecart Groups 2, 5, and 12. This is a post from HackRead.com Read the original post: UltraRank hackers compromised 100s of websites via JS-Sniffer attacks...

CVE-2020-5623

NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

Brave Software: Redirecting users to malicious torrent-files/websites using WebTorrent

Summary: An attacker can redirect a user to a malicious torrent file/website using a reverse tab-nabbbing flaw in WebTorrent. Description WebTorrent allows user to open files after download of while they are being downloaded directly from the browser F965466 An attacker can use this to redirect...

Shoring Up the 2020 Election: Secure Vote Tallies Aren't the Problem

With the 2020 U.S. Presidential Election coming up in just two months, cybersecurity concerns are taking center stage for average citizens and politicians. That said, the likelihood of election results being impacted by an attack are slim, security researchers say. The focus should be on other...

CVE-2020-10775

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer...

Open redirect

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer...

The vulnerability of the Windows Media Foundation component in Windows operating systems allows attackers to install programs, view, modify, or delete data with the privileges of a legitimate user.

The vulnerability of the Windows Media Foundation component in Windows operating systems arises from operations that occur outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to install programs, view, modify, or delete data with the privileges of a legitimate use...

ReconSpider - Most Advanced Open Source Intelligence (OSINT) Framework For Scanning IP Address, Emails, Websites, Organizations

ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers, Penetration Testers, Bug Hunters and Cyber Crime Investigators to find de...

CVE-2020-1380

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully...

Avito: link.avito.ru - Bypass of restrictions on external links.

Hello Avito! On "link.avito.ru" subdomain of "www.avito.ru" attacker able to bypass restriction for dangerous external links via trusted domain google.com. This scenario may be also possible with all other trusted subdomains of avito such as "yandex.ru" and so on, but in this example i'm used...