Projectworlds Online Shopping System SQL注入漏洞

Projectworlds Online Shopping System is an online shopping system from Projectworlds Austria. v1.0 of ProjectWorlds Online Shopping System is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Projectworlds Hospital Management System SQL注入漏洞

Projectworlds Hospital Management System is a hospital management system from Projectworlds Austria.Projectworlds Hospital Management System is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

Video Sharing Website SQL注入漏洞

Video Sharing Website is a video sharing website. video Sharing Website is vulnerable to SQL injection in v1.0, which stems from the application's lack of validation of externally entered SQL statements. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive...

Simple Forum-Discussion System SQL注入漏洞

Simple Forum-Discussion System is a simple forum/discussion system. SQL injection vulnerability exists in Simple Forum-Discussion System, which originates in various components such as manage topic.php, manage user.php and ajax.php. Lack of validation of externally entered SQL statements. An...

WordPress StopBadBots plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. StopBadBots Plugin is a WordPress open source application plugin. WordPress StopBadBots Plugin in versions prior to...

WordPress SEO Booster plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. SEO Booster plugin is a WordPress open source application plugin. WordPress SEO Booster plugin has a SQL injection...

400 Banks’ Customers Targeted with Anubis Trojan

Customers of Chase, Wells Fargo, Bank of America and Capital One, along with nearly 400 other financial institutions, are being targeted by a malicious app disguised to look like the official account management platform for French telecom company Orange S.A. Researchers say this is just the...

Romanian arrested for ransomware attacks and data theft

By Deeba Ahmed Europol has confirmed arresting a Romanian national for targeting an IT firm in the country. This is a post from HackRead.com Read the original post: Romanian arrested for ransomware attacks and data theft...

Karakurt: A New Emerging Data Theft and Cyber Extortion Hacking Group

A previously undocumented, financially motivated threat group has been connected to a string of data theft and extortion attacks on over 40 entities between September and November 2021. The hacker collective, which goes by the self-proclaimed name Karakurt and was first identified in June 2021, i...

A week in security (Dec 6 – 12)

Last week on Malwarebytes Labs: Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend Click “OK” to defeat MFA Fake job interviews plague major game developers like Riot Games and Rockstar Has your WordPress site been backdoored by a skimmer? What is a search engine and why does...

Security Bulletin: Vulnerabilities in Jackson, jQuery, and Dom4j affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Jackson, jQuery, and Dom4j, such as execution of arbitrary code, cross-site scripting, and obtaining sensitive information, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID: CVE-2020-24616 DESCRIPTION: FasterXML jackson-databind could allow a...

GHSA-VRC7-6G8W-JH56 Improper Input Validation in xdLocalStorage

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the...

Unitrends Backup SQL Injection Vulnerability

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A SQL injection vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China. A SQL injection vulnerability exists in ZZCMS, which stems from a lack of validation of externally entered SQL statements when registering regular users in dl/dldownload.php. An attacker could use this vulnerability to execute...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China. ZZCMS is vulnerable to SQL injection, which stems from a missing validation of externally entered SQL statements in the id parameter of admin/dlsendmail.php. An attacker could use this vulnerability to execute illegal SQL...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the Zzcms team in China. zzcms is vulnerable to SQL injection, which allows an attacker to use the id parameter in admin/bad.php with a lack of validation for external input SQL statements. An attacker can use the vulnerability to execute illegal SQL...

Is your web browser vulnerable to data theft? XS-Leak explained

In recent news, IT security researchers from Ruhr-Universität Bochum RUB and the Niederrhein University of Applied Sciences have disclosed 14 new cross-site leak also known as XSLeak or XS-Leak attacks that can affects modern browsers, such as Google Chrome, Microsoft Edge, Mozilla Firefox, and...

Microsoft disrupts China-based hacking group Nickel

Microsoft has taken control of 42 web domains that a hacking group was using to try to breach its targets. On December 2, the Microsoft Digital Crimes Unit DCU filed pleadings with the US District Court for the Eastern District of Virginia seeking authority to take control of the sites that it...

SolarWinds Hackers Targeting Government and Business Entities Worldwide

Nobelium, the threat actor attributed to the massive SolarWinds supply chain compromise, has been once again linked to a series of attacks targeting multiple cloud solution providers, services, and reseller companies, as the hacking group continues to refine and retool its tactics at an alarming...

Unitrends Backup SQL注入漏洞

Unitrends Backup is designed to eliminate data loss, ransomware and risk. A SQL injection vulnerability exists in versions of Unitrends Backup prior to 10.5.5, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...