U.S. Dept Of Defense: CSRF to XSS

The vulnerability allowed an attacker to combine Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. The XSS vulnerability allowed the injection of malicious scripts that could be executed in the victim's browser, potentially stealing sensitive data like cookies or session token...

SEMCMS SQL Injection Vulnerability (CNVD-2024-39254)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A SQL injection vulnerability exists in SEMCMS version 4.8, which originates from the lack of validation of external SQL statements in SEMCMSMain.php. An attacker can exploit this vulnerability to execut...

Vehicle Management edit1.php File SQL Injection Vulnerability

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the /edit1.php file parameter sno. An attacker can exploit this vulnerability to execute illegal SQL comman...

CVE-2024-8770

A Cross-Site Scripting XSS vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version...

The vulnerability of Intel Microcode processors lies in the default access settings, which allow attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of Intel Microcode processors relates to the default access rights settings. Exploiting this vulnerability allows attackers to gain access to confidential data, compromise its integrity, and cause service failures...

Code-Projects Vehicle Management SQL注入漏洞

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the /edit1.php file parameter sno. An attacker can exploit this vulnerability to execute illegal SQL comman...

MAL-2024-12261 Malicious code in easypydb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by...

Malicious code in easypydb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by...

SEMCMS 安全漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A SQL injection vulnerability exists in SEMCMS version 4.8, which originates from the lack of validation of external SQL statements in SEMCMSMain.php. An attacker can exploit this vulnerability to execut...

Hospital Management System check_availability.php File SQL Injection Vulnerability

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the email parameter of the checkavailability.php file. An attacker can exploit this...

Healthcare's Diagnosis is Critical: The Cure is Cybersecurity Hygiene

Cybersecurity in healthcare has never been more urgent. As the most vulnerable industry and largest target for cybercriminals, healthcare is facing an increasing wave of cyberattacks. When a hospital's systems are held hostage by ransomware, it's not just data at risk — it's the care of patients...

Microsoft Warns of New INC Ransomware Targeting U.S. Healthcare Sector

Microsoft has revealed that a financially motivated threat actor has been observed using a ransomware strain called INC for the first time to target the healthcare sector in the U.S. The tech giant's threat intelligence team is tracking the activity under the name Vanilla Tempest formerly DEV-083...

RAMBO Attack: Electromagnetic Waves Steal Data from Air-Gapped Systems

Discover the RAMBO attack, a groundbreaking method that uses electromagnetic waves to steal data from air-gapped systems. Learn…...

Code-Projects Hospital Management System SQL注入漏洞

Hospital Management System a hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the email parameter of the checkavailability.php file. An attacker can exploit this...

Inventory Management viewProduct.php File SQL Injection Vulnerability

Inventory Management is an inventory management system. Inventory Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter id of the file /model/viewProduct.php. An attacker can exploit this vulnerability to...

New Android Malware 'Ajina.Banker' Steals Financial Data and Bypasses 2FA via Telegram

Bank customers in the Central Asia region have been targeted by a new strain of Android malware codenamed Ajina.Banker since at least November 2023 with the goal of harvesting financial information and intercepting two-factor authentication 2FA messages. Singapore-headquartered Group-IB, which...

PartnerLeak scam site promises victims full access to “cheating” partner’s stolen data

Earlier this week, we reported on a new type of scam that tells you your partner is cheating on you. However, we hit a dead end because we were unable to get hold of an original copy of the email. That was until the scammers were “kind enough” to send one to one of our co-workers. your partner is...

Code-Projects Inventory Management System SQL注入漏洞

Inventory Management is an inventory management system. Inventory Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter id of the file /model/viewProduct.php. An attacker can exploit this vulnerability to...

3DSecure 2.0 3DS Method Authentication Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Method Authentication Tested Versions: 3DSecure 2.0 3DS Method Authentication Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solutio...

Blind Eagle Targets Colombian Insurance Sector with Customized Quasar RAT

The Colombian insurance sector is the target of a threat actor tracked as Blind Eagle with the end goal of delivering a customized version of a known commodity remote access trojan RAT referred to as Quasar RAT since June 2024. "Attacks have originated with phishing emails impersonating the...