nuclei-templates

This is a community-curated list of templates for the nuclei engine to find security vulnerabilities in applications. The repository contains various templates for the scanner provided by the team and contributed by the community. The templates are the core of the nuclei scanner, which powers the...

Directory traversal

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

Binance receives the ban hammer from UK’s FCA

Binance, the worlds largest and most popular cryptocurrency exchange network, has had a rough few days. First, Japans financial regulator, the Financial Services Agency FSA, issued its second warning to Binance on Friday, 25 June, for operating in the country without permission The first warning...

Security update for python-bleach (important)

openSUSE Security Update: Security update for python-bleach Announcement ID: openSUSE-SU-2021:0571-1 Rating: important References: 1167379 1168280 1184547 Cross-References: CVE-2020-6816 CVE-2020-6817 CVE-2021-23980 CVSS scores: CVE-2020-6816 NVD : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

Twitch Will Act on ‘Serious’ Offenses That Happen Off-Stream

The new policy holds streamers to account for what happens on other services and in real life...

PatrowlHears - PatrowlHears - Vulnerability Intelligence Center / Exploits

PatrOwl provides scalable, free and open-source solutions for orchestrating Security Operations and providing Threat Intelligence feeds. PatrowlHears is an advanced and real-time Vulnerability Intelligence platform, including CVE, exploits and threats news. Try it now! To try PatrowlHears, instal...

Huawei EMUI Input Validation Denial of Service Vulnerability

Huawei Emui is an Android-based mobile operating system developed by Huawei of China. Huawei EMUI suffers from an input validation vulnerability, which can be exploited by remote attackers to submit special requests for out-of-bounds access and conduct denial-of-service attacks...

First Lady’s 'Be Best' Initiative Addresses Kids' Online Safety

First Lady Melania Trump has announced her initiative to help children be their best. As part of her initiative, the First Lady released a guide to help parents and other adults discuss online safety and responsibility with children. Children taught about internet safety, appropriate online...

Adobe Flash Player Security Updates (APSB17-42) - Linux

Adobe Flash Player is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:flashplayer...

Threat Outbreak Alert RuleID31440: Email Messages Distributing Malicious Software on November 24, 2017

Medium Alert ID: 56046 First Published: 2017 November 27 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31440 may contain the following files: Name |...

Threat Outbreak Alert RuleID31217: Email Messages Distributing Malicious Software on November 7, 2017

Medium Alert ID: 55794 First Published: 2017 November 7 13:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31217 may contain the following files: Name |...

Cross site request forgery (csrf)

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

Man-In-The-Middle (MitM)

excon is vulnerable to man-in-the-middle MitM attacks. The rubygems source is deprecated because HTTP requests are insecure. A malicious user can potentially compromise the source to conduct MitM attacks...

'Bitcoin is Now Officially a Commodity' — US Regulator Declared

Bitcoins are making their way, in Bits and Pieces. In a recent report The Hacker News THN had mentioned about banks adopting the Blockchain Technology from Bitcoins; to create a safe and secure distributed ledger. Now, last week U.S. Commodity Future Trading Commission CFTC, has added Bitcoins an...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...

AT&T Warns Customers of Data Breach

AT&T has notified some of its mobile customers that employees of one of its contractors accessed some customer information, including birth dates and Social Security numbers, in an effort to generate codes that could be used to unlock devices. The company did not specify how many customers were...

CVE-2012-2899

Removed by vendor...

Trouble for Borderlands 2 Players

Some XBOX Live users have violated the online gaming platform’s code of conduct by using a malicious application that allowed them to permanently kill off the characters of other players in the popular ‘Borderlands 2’ video game. On a forum run by the game’s software developer Gearbox, a communit...

U.S. Dept. Of Commerce Calls For Online Code Of Business Conduct

The Department of Commerce’s Internet Policy Task Force released a proposal Wednesday calling for a voluntary code of conduct for companies that do business online. The Report, titled Cybersecurity, Innovation and the Internet Economy, calls for a private-public partnership to promote best securi...

Report: FCC May Push ISPs To Crack Down on Botnets

We’ve known for a long time that botnets are the Madwoman in the Attic at most major Internet service providers ISPs- an unseemly and occasionally embarrassing presence that is occasionally dealt with, but usually silently tolerated. But now, it seems, there’s pressure mounting on ISPs to do...