Tesla Remotely Hacked from a Drone

This is an impressive hack: Security researchers Ralf-Philipp Weinmann of Kunnamon, Inc. and Benedikt Schmotzle of Comsecuris GmbH have found remote zero-click security vulnerabilities in an open-source software component ConnMan used in Tesla automobiles that allowed them to compromise parked ca...

Passwordstate Warns of Ongoing Phishing Attacks Following Data Breach

Click Studios, the Australian software firm which confirmed a supply chain attack affecting its Passwordstate password management application, has warned customers of an ongoing phishing attack by an unknown threat actor. "We have been advised a bad actor has commenced a phishing attack with a...

iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices

Apple recently released iOS 14.5 and iPadOS 14.5 which include a security update that addresses almost 50 vulnerabilities including several critical RCE and privilege escalation vulnerabilities. Qualys recommends security teams to immediately update all devices running iOS and iPadOS to the lates...

Password manager hijacked to deliver malware in supply chain attack

In the latest example of a supply chain attack, cybercriminals delivered malware to customers of the business password manager Passwordstate by breaching its developer’s networks and then deploying a fraudulent update last week, said Passwordstate’s maker, Click Studios. Though the number of...

Passwordstate Password Manager Update Hijacked to Install Backdoor on Thousands of PCs

Click Studios, the Australian software company behind the Passwordstate password management application, has notified customers to reset their passwords following a supply chain attack. The Adelaide-based firm said a bad actor used sophisticated techniques to compromise the software's update...

WordPress WP Content Copy Protection & No Right Click plugin <= 3.1.4 - Arbitrary Plugin Installation and Activation vulnerability

Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress WP Content Copy Protection & No Right Click plugin versions = 3.1.4. Solution Update the WordPress WP Content Copy Protection & No Right Click plugin to the latest available version at least 3.1.5...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Apr 2021)

This host is missing a critical security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Description of the security update for Outlook 2016: April 13, 2021 (KB4504712)

None None...

CVE-2021-30481

Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click...

PT-2021-18753

Name of the Vulnerable Software and Affected Versions Valve Steam through 2021-04-10 Description The issue allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click when a Source engine game is installed. This is relate...

Linux Kernel 5.4 BleedingTooth Remote Code Execution

/ BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution by Andy Nguyen theflow@ This Proof-Of-Concept demonstrates the exploitation of CVE-2020-12351 and CVE-2020-12352. Compile using: $ gcc -o exploit exploit.c -lbluetooth and execute as: $ sudo ./exploit targetmac sourceip sourceport ...

CVE-2021-20688

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20688

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20688

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-20688

CVE-2021-20688 is a cross-site scripting vulnerability affecting Click Ranker Ver.3.5. The description states a stored XSS flaw allowing remote attackers to inject an arbitrary script via unspecified vectors, potentially executing in the browser of users visiting a page using Click Ranker. Exploi...

CVE-2021-20688

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

PT-2021-14147

Name of the Vulnerable Software and Affected Versions: Click Ranker version 3.5 Description: A cross-site scripting issue allows remote attackers to inject an arbitrary script via unspecified vectors. Recommendations: For Click Ranker version 3.5, update to a version that addresses this issue, as...

CVE-2021-20688: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content such as SVG with HTML content, the payload is executed upon a click. This is fixed in 3.5...