Open redirect

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cau...

CVE-2020-5270 Open redirection when using back parameter of PrestaShop

In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cau...

USN-4331-1: WebKitGTK+ vulnerability

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

Design/Logic Flaw

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

Western Digital My Cloud Home and ibi Websites Clickjacking Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud Home and ibi Websites versions prior to 2.2.0. An attacker could exploit the vulnerability to hijack click-through actions on the login page...

COVID-19 Has United Cybersecurity Experts, But Will That Unity Survive the Pandemic?

The Coronavirus has prompted thousands of information security professionals to volunteer their skills in upstart collaborative efforts aimed at frustrating cybercriminals who are seeking to exploit the crisis for financial gain. Whether it's helping hospitals avoid becoming the next ransomware...

VBScript Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerabili...

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully...

VBScript Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerabili...

2 San Francisco Int. airport websites hacked with info-stealer code

By Deeba Ahmed According to a data breach notification released by authorities... This is a post from HackRead.com Read the original post: 2 San Francisco Int. airport websites hacked with info-stealer code...

Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4317-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4317-1 advisory. Two use-after-free bugs were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could explo...

Watering-Holes Target Asian Ethnic Victims with Flash Update Decoy

An extensive campaign has surfaced that targets Windows users belonging to a specific Asian religious and ethnic group. The attack making use of a series of watering-hole websites and a drive-by download gambit relying on fake Flash updates. According to analysis from Kaspersky, released on...

USN-4310-1 webkit2gtk vulnerability

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

“Operation Poisoned News” infecting iPhones with LightSpy spyware

By Deeba Ahmed The operation uses "Local News Websites" to spread spyware infection. Here's what's going on and how. This is a post from HackRead.com Read the original post: "Operation Poisoned News" infecting iPhones with LightSpy spyware...

Unauthorized Access Vulnerability in Jiuan Video Surveillance Devices

Guangzhou Jiuan Intelligent Technology Company Limited JUAN is a leading global provider of mobile mapping infrastructure and IoT platform. An unauthorized access vulnerability exists in JUAN's video surveillance devices, which can be exploited by attackers to obtain sensitive information from...

Unspecified Vulnerability in Apple iOS and iPadOS Safari Components (CNVD-2020-23219)

Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Safari is a component of the Safari browser.Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability in the Safari component of Apple iOS prior to...

Criminals hack Tupperware website with credit card skimmer

Update 2: A spokesperson for Tupperware has given a public statement to Alex Scroxton, Security Editor at ComputerWeekly. You can read it here. Update: Following our blog post, we continued to monitor the Tupperware website. As of 03/25 at 1:45 PM PT, we noticed that the malicious PNG file had be...

Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission

The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...