147 matches found
womenwhotest.com Improper Access Control vulnerability OBB-2207992
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
virt-who bug fix and enhancement update
An update is available for virt-who. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virt-who service collects information about the connection between the...
GHSA-5V95-V8C8-3RH6 Privilege escalation in rbac
Impact Using a carefully crafted request or malicious proxy, a user with UserWrite permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log. Patches The issue has been fix...
virt-who bug fix and enhancement update
An update is available for virt-who. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpris...
Authorities take down scam campaign impersonating the WHO
By Habiba Rashid The group behind the campaign was DarkPath Scammers, who had created a distributed network of 134 rogue websites impersonating the WHO. This is a post from HackRead.com Read the original post: Authorities take down scam campaign impersonating the WHO...
WHO COVID-19 Mobile App: ArcGIS Rest Service linked to unsecured survey data
ArcGIS rest service url was followed, allowing discovery of unsecured survey data. Now fixed. This wasn't part of the WHO COVID-19 Mobile App but was resolved as it was reported here...
WHO COVID-19 Mobile App: Internal API endpoint is accesible for everyone
Summary: It looks like the endpoint /internal/cron/refreshCaseStats as configured in cron.yaml https://github.com/WorldHealthOrganization/app/blob/master/server/appengine/src/main/webapp/WEB-INF/cron.yamlL3 is accesible for everyone. Since it is configured as a cronjob to run every 5 minutes and...
Command Execution Vulnerability in Followers (Windows Client)
Followers Learning, which is affiliated with Beijing Baike Internet Technology Co. The program services provided by Followers Learning cover the categories of primary and secondary school culture classes, practical English, workplace, certification, study abroad, graduate school, family education...
chat.nerdswhoprogram.com Cross Site Scripting vulnerability OBB-1288243
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ukwhoswho.com Open Redirect vulnerability OBB-1270297
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
‘Hack-For-Hire’ Firms Spoof WHO To Target Google Credentials
“Hack-for-hire” organizations are the latest group of cybercriminals to take advantage of the ongoing coronavirus pandemic, using COVID-19 as a lure in phishing emails bent on stealing victims’ Google credentials. Researchers with Google’s Threat Analysis Group TAG warned that they’ve spotted a...
Exclusive: Scammers using fake WHO Bitcoin wallet to steal donation
By Waqas Scammers are disguising as representatives from the World Health Organization WHO to scam... This is a post from HackRead.com Read the original post: Exclusive: Scammers using fake WHO Bitcoin wallet to steal donation...
Watch: Flaw exploited to post fake COVID-19 clips from TikTok accounts
By Deeba Ahmed In their demonstration, researchers showed how they published fake COVID-19 videos from WHO and TikTok's official accounts. This is a post from HackRead.com Read the original post: Watch: Flaw exploited to post fake COVID-19 clips from TikTok accounts...
WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users
Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...
Spearphishing Campaign Exploits COVID-19 To Spread Lokibot Infostealer
Researchers have discovered threat actors once again capitalizing on the COVID-19 pandemic and current attention on the World Health Organization WHO with a new spearphishing email designed to spread the LokiBot trojan sent using the WHO trademark as a lure. Researchers at FortiGuard Labs on Marc...
WHO COVID-19 Mobile App: Probably unexploitable XSS via Header Injection
Summary: The Who-Platform header is reflected in the output of the page if it's not one of the recognized Who-Platform values IOS, ANDROID, WEB. While this is probably no longer exploitable as of 2015, it may be exploitable on less well implemented browsers not Chrome/Firefox/Edge. In general,...
Top Email Protections Fail in Latest COVID-19 Phishing Campaign
Threat actors continue to capitalize on fears surrounding the spread of the COVID-19 virus through a surge in new phishing campaigns that use spoofing tactics to effectively evade Proofpoint and Microsoft Office 365 advanced threat protections ATPs, researchers have found. The Cofense Phishing...
Hackers are actively targeting WHO amid Coronavirus pandemic
By Deeba Ahmed From phishing, malware and ransomware to identity theft; hackers are actively targeting WHO amid Coronavirus pandemic. This is a post from HackRead.com Read the original post: Hackers are actively targeting WHO amid Coronavirus pandemic...
A week in security (March 16 – 22)
Last week on Malwarebytes Labs, we concluded our series on child identity theft. We also looked into threat actors and campaigns that ride the COVID-19 train, namely the criminal group APT36 and threat actors purporting to be the World Health Organization WHO but instead spreading malware. Lastly...
Fake Coronavirus ‘Vaccine’ Website Busted in DoJ Takedown
The Department of Justice has raised its first federal court action against online fraud relating to the coronavirus pandemic, on Sunday taking steps to shutter a fraudulent website that claimed to give away free coronavirus vaccines. The website, “coronavirusmedicalkit.com,” was purporting to gi...