CVE-2019-19113

CVE-2019-19113 affects newbee-mall (New Bee) before 2019-10-23. The flaw is in main/resources/mapper/NewBeeMallGoodsMapper.xml where search?goodsCategoryId=&keyword= allows SQL Injection due to lack of validation of external input. No explicit patch/version details are provided in the connected d...

bee-craft.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-959123 Security Researcher OmniGooch Helped patch 3835 vulnerabilities Received 5 Coordinated Disclosure badges Received 10 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting bee-craft.com website and...

A week in security (August 12 – 18)

Last week on Malwarebytes Labs, we took a look at the potential pitfalls of facial recognition technology, looked at ways domestic abuse survivors can secure their data, and explored the education threat landscape. We also kicked off a series looking at the Hidden Bee infection chain, and put...

The Hidden Bee infection chain, part 1: the stegano pack

About a year ago, we described the Hidden Bee miner delivered by the Underminer Exploit Kit. Hidden Bee has a complex and multi-layered internal structure that is unusual among cybercrime toolkits, making it an interesting phenomenon on the threat landscape. That's why we're dedicating a series o...

A week in security (May 27 – June 2)

Last week on Malwarebytes Labs, we took readers through a deep dive—way down the rabbit hole—into the novel malware called “Hidden Bee.” We also looked at the potential impact of a government agency’s privacy framework, and delivered to readers everything they needed to know about ATM attacks and...

Hidden Bee: Let’s go down the rabbit hole

Some time ago, we discussed the interesting malware, Hidden Bee. It is a Chinese miner, composed of userland components, as well as of a bootkit part. One of its unique features is a custom format used for some of the high-level elements this format was featured in my recent presentation at SAS...

Exploit kits: spring 2019 review

Exploit kit activity remains fairly unchanged since our last winter review in terms of active distribution campaigns. But this spring edition will feature a new exploit kit and another atypical EK, in that it specifically goes after routers. The main driver behind these drive-by download attacks...

Underminer exploit kit improves in its latest iteration

One of the most interesting exploit kits we track is also a bit of an elusive one, and as such does not receive the same scrutiny as its RIG and Fallout counterparts. Underminer was mentioned in our Fall 2018 round up, and at the time was using CVE-2018-8174 Internet Explorer and CVE-2018-4878...

bee-cms.ru XSS vulnerability

Open Bug Bounty ID: OBB-675726 Description| Value ---|--- Affected Website:| bee-cms.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

To see the Hidden Bee how to use a new vulnerability propagation-vulnerability warning-the black bar safety net

! Write in front of words Recently we found a to attempt to exploit CVE-2018-4878 Flash Player vulnerability, vulnerability to attack, its sequence and we currently find any loopholes to use the tool are not the same. After investigation, we found that this is a Chinese security company qihoo 360...

‘Hidden Bee’ miner delivered via improved drive-by download toolkit

This blog post was authored by @hasherezade and Jérôme Segura. We recently detected a drive-by download attack trying to exploit CVE-2018-4878, a vulnerability in Flash Player, in a sequence that was not matching any of the exploit kit patterns that we currently track. Upon investigation, we...

clients.bee-on-web.fr XSS vulnerability

Open Bug Bounty ID: OBB-595234 Description| Value ---|--- Affected Website:| clients.bee-on-web.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

classifieds.fresnobee.com XSS vulnerability

Vulnerable URL: http://classifieds.fresnobee.com/ca/all-categories/search?searchtype=advanced"'--!prompt/OPENBUGBOUNTY///...

ESET Endpoint Antivirus 6 Remote Code Execution

CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6 --------------------------------------------------------------------------- Summary ======= Name: Remote Code Execution as Root via ESET Endpoint Antivirus 6 CVE: CVE-2016-9892 Discoverers: Jason Geffner and Jan Bee Vendo...

Maya the Bee: Flowerparty Lite - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Maya the Bee: Flowerparty Lite published at the 'play' market has multiple vulnerabilities...

Maya the Bee: Play and Learn - Base64 encoded String, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Maya the Bee: Play and Learn published at the 'play' market has multiple vulnerabilities...

Bee Bubble - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bee Bubble published at the 'play' market has multiple vulnerabilities...

Bee Brilliant - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Bee Brilliant published at the 'play' market has multiple vulnerabilities...

sewing-bee.co.uk XSS vulnerability

Vulnerable URL: http://www.sewing-bee.co.uk/shop/basketnew.php?pagefile=" Details: Description| Value ---|--- Patched:| Yes, at 07.12.2015 Latest check for patch:| 07.12.2015 16:22 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

Design/Logic Flaw

The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6, 14.1 before 14.1R4, 14.1X50 before 14.1X50-D70, and 14.2 before 14.2R2, when configured as a broadband edge BBE router, allows remote attackers to cause a denial of service jpppd crash and restart by sending a crafted P...