2167 matches found
ManageEngine Service Desk 10.0 - Cross-Site Scripting
Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.html Version: 10.0 10000.0.0.0 Tested on: Window...
ManageEngine Service Desk 10.0 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link:...
Directory Traversal
Overview io.jooby:jooby is a modular web framework for Java and Kotlin. Affected versions of this package are vulnerable to Directory Traversal. There are two ways this vulnerability can be leveraged: When sharing a File System directory as in: assets"/static/", Paths.get"static" The class path...
Directory Traversal
Overview org.jooby:jooby is a modern, performant and easy to use web framework for Java and Kotlin built on top of your favorite web server. Affected versions of this package are vulnerable to Directory Traversal. There are two ways this vulnerability can be leveraged: When sharing a File System...
Logic Flaw Vulnerability in FuturXE
FuturXE FXE is an ethereum-based virtual currency.A security vulnerability exists in the 'transferFrom' function in FXE's smart contract implementation, which stems from a logic error in the program. An attacker could exploit the vulnerability to make an unauthorized transfer of digital assets...
DestiNeed has a flawed logic vulnerability
DestiNeed DSN is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in DSN's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...
RiptideCoin has a logic flaw vulnerability
RiptideCoin RIPT is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of RIPT's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...
MoneyChainNet has a flawed logic vulnerability
MoneyChainNet MCN is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in MCN's smart contract implementation. An attacker could use this vulnerability to prevent the seller from accessing the assets due to the exchange...
GSI has a logic flaw vulnerability
GSI is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of GSI's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...
Hackers drain $25 million in assets from dForce
By Deeba Ahmed The type of attack method used by hackers is called Reentrancy. This is a post from HackRead.com Read the original post: Hackers drain $25 million in assets from dForce...
Malicious Package
Overview assets-offline is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using assets-offli...
Malicious Package
Overview assets-pipeline is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
Malicious Package
Overview font-assets is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using font-assets...
XSS and RCE vectors in laminas-api-tools/api-tools-documentation-swagger
The package laminas-api-tools/api-tools-documentation-swagger bundles a number of javascript assets for purposes of providing API documentation. Some of these assets had reported XSS cross-site scripting and RCE remote code execution vulnerabilities: Affected versions...
XSS vectors in laminas-api-tools/api-tools
The package laminas-api-tools/api-tools bundles a number of javascript assets for purposes of providing an adminstration GUI and/or landing page. Some of these assets had reported XSS cross-site scripting vulnerabilities: Affected versions laminas-api-tools/api-tools versions prior to 1.4.1. Acti...
Starbucks: Minimal information disclosure of internal asset names and links which were not publicly accessible.
e4366eolywrgpidfbio discovered an application with links to internal Starbucks related resources. No public access to these resources was available, resulting in minimal information disclosure of host and resource names. @e4366eolywrgpidfbio — thank you for reporting this issue...
Forrester report for Rapid7: number juggling and an excellent overview of Vulnerability Management problems
I recently read Forrester's 20-page report "The Total Economic Impact Of Rapid7 InsightVM". It is about the Cost Savings And Business Benefits that Vulnerability Management solution can bring to the organizations. In short, I didn't like everything related to money. It seems like juggling with...
Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation
Attackers will cross multiple domains like email, identity, endpoints, and applications to find the point of least resistance. Today’s defense solutions have been designed to protect, detect, and block threats for each domain separately, allowing attackers to exploit the seams and threshold...
M-Trends 2020: Insights From the Front Lines
Today we release M-Trends 2020, the 11th edition of our popular annual FireEye Mandiant report. This latest M-Trends contains all of the statistics, trends, case studies and hardening recommendations that readers have come to expect through the years—and more. One of the most exciting takeaways...
