ad-toya.com Cross Site Scripting vulnerability OBB-3950743

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Google admits it can’t quite quit third-party cookies

For more than a year, Google has said it would phase out the third-party tracking cookies that power much of its advertising business online, proposing new ideas that would allegedly preserve user privacy while still providing businesses with steady revenue streams. This week, Google tossed much ...

'Konfety' Ad Fraud Uses 250+ Google Play Decoy Apps to Hide Malicious Twins

Details have emerged about a "massive ad fraud operation" that leverages hundreds of apps on the Google Play Store to perform a host of nefarious activities. The campaign has been codenamed Konfety – the Russian word for Candy – owing to its abuse of a mobile advertising software development kit...

Advisory ROSA-SA-2024-2451

Software: samba 4.12.3 OS: ROSA Virtualization 2.1 packageevrstring: samba-4.12.3 CVE-ID: CVE-2020-25722 BDU-ID: 2022-00004 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the Active Directory Domain Controller component of the Samba networking software package is caused by a buffer overflow...

Citrix Daas - Authentication

Introduction This article is a summary of the top support articles and Product Documents related to Citrix DaaS Authentication Methods. The most commonly used support articles and guides are below. It is recommended that all customers refer to the product documentation for configuration related...

Fake Microsoft Teams for Mac delivers Atomic Stealer

Competition between stealers for macOS is heating up, with a new malvertising campaign luring Mac users via a fraudulent advert for Microsoft Teams. This attack comes on the heels of the new Poseidon OSX.RodStealer project, another threat using a similar code base and delivery techniques. Based o...

Malicious code in sap-ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef26a8198d5b872591cec2e0286ae5c638eebaab6e3957a071b93d903dc7ae45 The OpenSSF Package Analysis project identified 'sap-ad' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...

MAL-2024-7496 Malicious code in sap-ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef26a8198d5b872591cec2e0286ae5c638eebaab6e3957a071b93d903dc7ae45 The OpenSSF Package Analysis project identified 'sap-ad' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...

MAL-2024-7356 Malicious code in @zitterorg/quod-ad-doloribus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5e9394f45c936d3a1e5ffb74dd0f6a2409edff2d9857854d64d1357ca8ea24f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Meta's 'Pay or Consent' Approach Faces E.U. Competition Rules Scrutiny

Meta's decision to offer an ad-free subscription in the European Union E.U. has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the...

GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server

Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2024-37085

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management...

Malicious code in ad-search (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6505 Malicious code in ad-search (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1727 Malicious code in @realty-front/ad (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-37085

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management...

CVE-2024-6186

A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit.php. The manipulation of the argument adlogname leads to os command injection. It is possible to initiate the attack remotely. The exploi...

CVE-2023-49111

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...

CVE-2023-49111 Reflected Cross-Site-Scripting in Kiuwan SAST

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...

CVE-2023-49111

CVE-2023-49111 describes an unauthenticated reflected cross-site scripting vulnerability in Kiuwan SAST deployments with SSO enabled. The issue arises because the login page’s JavaScript block directly includes the request parameter “message,” enabling an attacker to inject script via the paramet...