Owners of 1-Time Passcode Theft Service Plead Guilty

Three men in the United Kingdom have pleaded guilty to operating otp.agency , a once popular online service that helped attackers intercept the one-time passcodes OTPs that many websites require as a second authentication factor in addition to passwords. Launched in November 2019, OTP Agency was ...

CVE-2024-45527

The web application REDCap version 14.7.0 is vulnerable to HTML injection due to a failure to properly sanitize the project title during a New Project action . This vulnerability allows an attacker to inject arbitrary HTML code, which can be leveraged to perform logout CSRF via index.php?logout=1...

The vulnerability of the software for licensing 1C:SLK products relates to the lack of measures taken to protect the website structure, allowing attackers to carry out XSS attacks.

The vulnerability of the software for licensing products of 1C:SLK is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the Relay Hosts Configuration function in the Docker-based deployment and email server management tool, mailcow:dockerized, allows a attacker to execute arbitrary code.

The vulnerability of the Relay Hosts Configuration function in the Docker-based deployment and email server management tool, mailcow:dockerized, is related to the lack of security measures for the website structure. Exploiting this vulnerability allows an attacker operating remotely to execute...

Vtiger CRM 安全漏洞

Vtiger CRM is a customer relationship management system CRM developed based on SugarCRM by Vtiger USA. The management system provides functions such as managing, collecting, and analyzing customer information. A security vulnerability exists in Vtiger CRM version 7.4.0, which stems from the...

News Portal 4.0 Insecure Direct Object Reference

============================================================================================================================================= | Title : News Portal v4.0 IDOR Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits | | Vendo...

SMS scammers use toll fees as a lure

In April 2024, the FBI warned about a new type of smishing scam. Smishing is the term we use for phishing attacks sent via text message. This particular smishing scam tries to trick users into clicking a link by telling them they owe a “small amount” in toll fees. The scammers send a text claimin...

CVE-2024-8217: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester E-Commerce Website 1.0 and classified as critical. This vulnerability affects unknown code of the file /Admin/registration.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has bee...

The vulnerability of the Calltouch analytics service lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary scripts.

The vulnerability of the Calltouch analytics service is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary scripts remotely...

CVE-2024-8139 itsourcecode E-Commerce Website search_list.php sql injection

A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file searchlist.php. The manipulation of the argument user leads to sql injection. The attack can be launched remotely. The exploit h...

CVE-2024-8139

CVE-2024-8139 affects itsourcecode E-Commerce Website 1.0. The issue is a SQL injection in the search_list.php logic triggered by manipulating the user parameter, exploitable remotely. Multiple connected sources confirm the vulnerability and public exploit disclosure. Remediation: upgrade to vers...

CVE-2024-8139: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file searchlist.php. The manipulation of the argument user leads to sql injection. The attack can be launched remotely. The exploit h...

Take a Selfie Using a NY Surveillance Camera

This site will let you take a selfie with a New York City traffic surveillance camera. EDITED TO ADD: BoingBoing post...

sjctni.edu Cross Site Scripting vulnerability OBB-3960307

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

nta.co.jp Cross Site Scripting vulnerability OBB-3960303

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Siemens SCALANCE M-800, RUGGEDCOM RM1224 Improper Input Validation (CVE-2024-41976)

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.1, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.1, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.1, SCALANCE M812-1 ADSL- Router family All versions V8.1, SCALANCE M816-1...

wvenc-f5.wvnet.edu Cross Site Scripting vulnerability OBB-3960275

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

loopearplugs.com Cross Site Scripting vulnerability OBB-3960273

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

roadsafety.kerala.gov.in Cross Site Scripting vulnerability OBB-3960253

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-P4FX-QF2H-JPMJ memos CORS Misconfiguration in server.go (GHSL-2024-034)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...