2735 matches found
Nextcloud: Event create can create attachments that link to other websites
The vulnerability allowed the creation of attachments that could link to other websites during the event creation process...
Hackers Exploit Magento Bug to Steal Payment Data from E-commerce Websites
Threat actors have been found exploiting a critical flaw in Magento to inject a persistent backdoor into e-commerce websites. The attack leverages CVE-2024-20720 CVSS score: 9.1, which has been described by Adobe as a case of "improper neutralization of special elements" that could pave the way f...
Cookie consent choices are just being ignored by some websites
In news that is, sadly, unlikely to shock you, new research indicates that many websites ignore visitors choices to refuse cookies and collect their data anyway. Researchers at the University of Amsterdam UvA analyzed 85,000 European websites and came to the conclusion that 90% of them violated a...
A vulnerability in the VMware SD-WAN Orchestrator management platform allows for the redirection of URLs to unreliable websites, enabling a hacker to redirect users to arbitrary URL addresses.
The vulnerability of the VMware SD-WAN Orchestrator management platform lies in the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...
The vulnerability of the Grafana monitoring and observation platform lies in the redirection of the URL address to an unreliable website, allowing a hacker to redirect users to any desired website.
The vulnerability of the Grafana monitoring and observation platform relates to bypassing security configurations, if a malicious data source operates on a permitted host. Exploiting this vulnerability could allow a remote attacker to redirect users to an arbitrary website...
Class-Action Lawsuit against Google’s Incognito Mode
The lawsuit has been settled: Google has agreed to delete "billions of data records" the company collected while users browsed the web using Incognito mode, according to documents filed in federal court in San Francisco on Monday. The agreement, part of a settlement in a class action lawsuit file...
Stealer Malwares Delivered Through Malicious Ads and Bogus Websites
Summary: Two distinct stealer malware programs, including Atomic Stealer, are being distributed to Apple macOS users through deceptive advertisements and counterfeit websites. These recent attacks have successfully infected victims macOS devices with infostealers. Threat Level - Red | Attack Repo...
Free VPN apps turn Android phones into criminal proxies
Researchers at HUMAN’s Satori Threat Intelligence have discovered a disturbing number of VPN apps that turn users devices into proxies for cybercriminals without their knowledge, as part of a camapign called PROXYLIB. Cybercriminals and state actors like to send their traffic through other people...
[SECURITY] Fedora 38 Update: ghc-hakyll-4.16.2.0-1.fc38
Hakyll is a static website compiler library. It provides you with the tools to create a simple or advanced static website using a Haskell DSL and formats su ch as markdown or RST. You can find more information, including a tutorial, on t he website:...
Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware
Malicious ads and bogus websites are acting as a conduit to deliver two different stealer malware, including Atomic Stealer, targeting Apple macOS users. The ongoing infostealer attacks targeting macOS users may have adopted different methods to compromise victims' Macs, but operate with the end...
Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions
A now-patched security flaw in the Microsoft Edge web browser could have been abused to install arbitrary extensions on users' systems and carry out malicious actions. "This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly instal...
AI Generated Fake Obituary Websites Target Grieving Users
By Waqas Tributes turned toxic as crooks abuse AI. This is a post from HackRead.com Read the original post: AI Generated Fake Obituary Websites Target Grieving Users...
Cross-Site Request Forgery (CSRF)
gradio is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to inadequate Cross-Origin Resource Sharing CORS validation, which allows an external websites to make requests to gradio applications running locally...
The vulnerability of ExpressVPN’s split-tunneling function allows a hacker to obtain confidential information about websites visited by VPN users.
The vulnerability of ExpressVPN’s split-tunneling service lies in the lack of protection for service-related data. Exploiting this vulnerability allows a malicious actor to obtain confidential information about websites visited by VPN users remotely...
Clickjacking
Firefox is vulnerable to Clickjacking. The vulnerability is due to permission prompt input delay expiring while the window is not in focus, allowing malicious websites to exploit it...
Thousands of WordPress Websites Hacked with New Sign1 Malware
By Waqas Using a Wordpress website? Lookout for Sign1 malware! This is a post from HackRead.com Read the original post: Thousands of WordPress Websites Hacked with New Sign1 Malware...
Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects
A massive malware campaign dubbed Sign1 has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites. The most recent variant of the malware is estimated to have infected no less than 2,500 sites over the past two months...
CVE-2023-42954
A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests...
