Automated WPA Phishing Attacks: WiFiPhisher

Wifiphisher is a security tool that mounts automated victim-customized phishing attacks against WiFi clients in order to obtain credentials or infect the victims with malwares. It is primarily a social engineering attack that unlike other methods it does not include any brute forcing. It is an ea...

CVE-2017-16567

Persistent Cross-Site Scripting XSS vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality...

PT-2017-14451 · Logitech · Logitech Media Server

Name of the Vulnerable Software and Affected Versions: Logitech Media Server version 7.9.0 Description: The issue is related to a Cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a favorite. This vulnerability can lead to Session...

Samsung Internet Browser SOP Bypass

This module takes advantage of a Same-Origin Policy SOP bypass vulnerability in the Samsung Internet Browser, a popular mobile browser shipping with Samsung Android devices. By default, it initiates a redirect to a child tab, and rewrites the innerHTML to gather credentials via a fake pop-up...

CVE-2017-15887

An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack...

True Luck Driver Mobile App Has Logic Design Flaws

True Luck Driver Mobile App is a mobile application that helps truck drivers find work. There is a logical design vulnerability in the True Luck Driver mobile app. An attacker can log into any user account by using the forget password function to capture packet blasting to obtain the verification...

Google Golang Go Information Disclosure Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An information disclosure vulnerability exists in Google Golang Go versions prior to 1.8.4 and 1.9.x versions prior to 1.9.1. An attacker can exploit this vulnerability to conduc...

CVE-2017-1000092

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenki...

Civil Liberties Activists Hit By Phishing Campaign

Digital civil liberties activists were hit with a barrage of phishing emails earlier this summer designed to wrest away business credentials. Activists with Fight for the Future, a nonprofit that’s campaigned against backdoors in mobile phones and for Net neutrality, and Free Press, a group that...

Attacker with Access to LXCA Filesystem Could Access Local LXCA Account Credentials and LXCA Authenticated Command Injection - Lenovo Support US

No description provided...

Cross site scripting

Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router...

CVE-2017-11320

Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router...

Technicolor TC7337 Stored Cross-Site Scripting Vulnerability

Technicolor TC7337 routers is a wireless router from Technicolor France. A cross-site scripting vulnerability exists in the Technicolor TC7337 router version 08.89.17.20.00. A remote attacker can exploit this vulnerability to cause DNS pollution and steal router credentials...

Foreman Redirect Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman, which is caused by the program failing to redirect HTTP...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

Two New Platforms Found Offering Cybercrime-as-a-Service to 'Wannabe Hackers'

Cybercrime has continued to evolve and today exists in a highly organised form. Cybercrime has increasingly been commercialised, and itself become big business by renting out an expanded range of hacking tools and technologies, from exploit kits to ransomware, to help anyone build threats and...

PT-2017-6817 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions 1.1 through 1.9.0-RC1 Description: The issue allows remote attackers to obtain user credentials via a man-in-the-middle attack because HTTP requests are not redirected to HTTPS when the require ssl setting is set to true...

Microsoft Addresses NTLM Bugs That Facilitate Credential Relay Attacks

NTLM has a long history of serious vulnerabilities and of causing anxiety for Windows and UNIX server admins. Their collective angst is unlikely to lessen today with the disclosure of a pair of new vulnerabilities in the protocol suite. Microsoft today patched one of the issues among its Patch...