PT-2019-14927

Name of the Vulnerable Software and Affected Versions Evernote versions prior to 7.13 GA on macOS Description The issue allows code execution due to the lack of the com.apple.quarantine attribute for attachment files. This can be exploited through a one-click attack by dragging and dropping a...

PT-2019-16902 · Ibm · Ibm Websphere Extreme Scale

Name of the Vulnerable Software and Affected Versions: IBM WebSphere eXtreme Scale version 8.6 Description: A remote attacker could hijack the clicking action of a victim by persuading them to visit a malicious Web site, potentially launching further attacks against the victim. Recommendations: F...

Thousands of PCs Affected by Nodersok/Divergent Malware

New malware identified by Microsoft and Cisco Talos has affected thousands of PCs in the United States and Europe and turns systems into proxies for performing malicious activity, the companies said. The fileless threat—called Nodersok by Microsoft and Divergent by Cisco Talos—has many of its own...

1-Click iPhone and Android Exploits Target Tibetan Users via WhatsApp

A team of Canadian cybersecurity researchers has uncovered a sophisticated and targeted mobile hacking campaign that is targeting high-profile members of various Tibetan groups with one-click exploits for iOS and Android devices. Dubbed Poison Carp by University of Toronto's Citizen Lab, the...

CVE-2019-4086

IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

Design/Logic Flaw

IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2019-4086

CVE-2019-4086 affects IBM Cloud Application Performance Management (APM) 8.1.4 (Base Private/Advanced Private) and related APM components. A remote attacker could hijack a victim’s clicking actions by enticing them to visit a malicious site, potentially enabling further attacks. The IBM advisory ...

PT-2019-16891 · Ibm · Ibm Application Performance Management

Name of the Vulnerable Software and Affected Versions: IBM Cloud Application Performance Management version 8.1.4 Description: A remote attacker could hijack the clicking action of a victim by persuading them to visit a malicious Web site, potentially launching further attacks against the victim...

CVE-2019-4086: Improper Restriction of Rendered UI Layers or Frames

IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

PortSwigger Web Security: Clicking "http://burp" hyperlink on FireFox CA Installation guide redirects to "burp.com" (unclaimed website).

Executive Summary --------------------------------------------------- I was in the process of installing Burp suite community edition on my recent machine where I believe I stumbled across a potential open redirect issue on the CA certificate installation website. This is a security concern due t...

Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Sep 2019)

This host is missing an important security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Exploit Reseller Offering Up To $2.5 Million For Android Zero-Days

Well, there's some good news for hackers and vulnerability hunters, though terrible news for Google, Android device manufacturers, and their billions of users worldwide. The zero-day buying and selling industry has recently taken a shift towards Android operating system, offering up to $2.5 milli...

WordPress one-click-ssl plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. one-click-ssl is an SSL Transport Layer Security setup plugin that is used in it. A cross-site request forgery vulnerability exists in...

CVE-2019-15828

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...

CVE-2019-15828

CVE-2019-15828 affects the WordPress one-click-ssl plugin, vulnerable prior to v1.4.7 to CSRF. Multiple connected sources confirm lack of CSRF/authorization checks on settings and AJAX methods, enabling unauthorized changes via crafted requests. CVSS data from NVD indicates high impact (C/H, I/H,...

CVE-2019-15828

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...

CVE-2019-15828

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...

CVE-2019-15828: Cross-Site Request Forgery (CSRF)

The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...

PT-2019-14430

Name of the Vulnerable Software and Affected Versions facebook-for-woocommerce plugin versions prior to 1.9.15 Description The issue concerns a CSRF vulnerability. It can be exploited via specific API endpoints such as "ajax woo infobanner post click", "ajax woo infobanner post xout", or "ajax fb...

PT-2019-14417

Name of the Vulnerable Software and Affected Versions one-click-ssl plugin versions prior to 1.4.7 Description The issue allows for CSRF. Recommendations For versions prior to 1.4.7, update to version 1.4.7 or later to resolve the issue...