6488 matches found
New Android malware poses as “System Update” to steal your data
By Deeba Ahmed The malware is also capable of controlling the device's front and back camera to take photos periodically. This is a post from HackRead.com Read the original post: New Android malware poses as "System Update" to steal your data...
Watch Out! That Android System Update May Contain A Powerful Spyware
Researchers have discovered a new information-stealing trojan, which targets Android devices with an onslaught of data-exfiltration capabilities — from collecting browser searches to recording audio and phone calls. While malware on Android has previously taken the guise of copycat apps, which go...
CVE-2021-23888
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user...
PT-2021-15590 · Mcafee · Mcafee Epolicy Orchestrator
Name of the Vulnerable Software and Affected Versions: McAfee ePolicy Orchestrator versions prior to 5.10 Update 10 Description: The issue is related to an unvalidated client-side URL redirect, which could allow an authenticated user to load an untrusted site in an ePO iframe, potentially leading...
Moodle Atto Editor Cross Site Scripting
Exploit Title: Moodle Atto Editor Cross Site Scripting Date: 26.03.2021 Author: Vincent666 ibn Winnie Software Link: https://moodle.org/plugins/editoratto Tested on: Windows 10 Web Browser: Mozilla Firefox Google Dorks: inurl:/lib/editor/atto/plugins/managefiles/ or calendar/view.php?view=month M...
Cross-site Scripting (XSS) - Generic in maxsite/cms
✍️ Description Cross-site scripting also known as XSS is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites...
Microsoft Exchange Servers See ProxyLogon Patching Frenzy
The patching level for Microsoft Exchange Servers that are vulnerable to the ProxyLogon group of security bugs has reached 92 percent, according to Microsoft. The computing giant tweeted out the stat earlier this week – though of course patching won’t fix already-compromised machines. Still, that...
Weak password vulnerability in Huawei AR Web Management Platform (CNVD-2021-25876)
Huawei Technologies Co., Ltd, founded in 1987, is headquartered in Longgang District, Shenzhen, Guangdong Province. 1 Huawei is a leading global information and communications technology ICT solutions provider, specializing in the ICT field, adhering to sound management, continuous innovation and...
Phish Leads to Breach at Calif. State Controller
A phishing attack last week gave attackers access to email and files at the California State Controllers Office SCO, an agency responsible for handling more than $100 billion in public funds each year. The phishers had access for more than 24 hours, and sources tell KrebsOnSecurity the intruders...
Why Banks Are Still A Top Target For DDoS Attacks
The financial services sector is still a prime target for cyber criminals and it has been widely reported that in 2020 financial institutions came under attack more than ever before. According to Boston Consulting Group research, financial service firms are up to 300 times more likely to experien...
SQL Injection Vulnerability in Website Building System of Nantong XED Software Co. Ltd (CNVD-2021-22607)
Nantong XED Software Co., Ltd. is a professional company engaged in website production, Internet marketing, SEO optimization. Nantong XED Software Co., Ltd. website building system has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the...
Mimecast: SolarWinds Attackers Stole Source Code
Hackers who compromised Mimecast networks as part of the SolarWinds espionage campaign have swiped some of the security firm’s source code repositories, according to an update by the company. The email security firm initially reported that a certificate compromise in January was part of the...
Magecart Attackers Save Stolen Credit-Card Data in .JPG File
Magecart attackers have found a new way to hide their nefarious online activity by saving data they’ve skimmed from credit cards online in a .JPG file on a website they’ve injected with malicious code. Researchers at website security firm Sucuri discovered the elusive tactic recently during an...
USN-4872-1: Axel vulnerability
It was discovered that Axel did not properly verify the certificates for hostnames. An attacker could use this vulnerability to impersonate another server and obtain sensitive information...
Chinese hackers using RedXOR backdoor against Linux systems
By Deeba Ahmed RedXOR malware can steal data, gather system information such as the MAC address, username, clock speed, distribution, and kernel version, etc. This is a post from HackRead.com Read the original post: Chinese hackers using RedXOR backdoor against Linux systems...
NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)
The remote NewStart CGSL host, running version MAIN 4.06, has firefox packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable...
DEBIAN-CVE-2021-21185
Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome Extension...
Google Play Harbors Malware-Laced Apps Bent on Spying
A malware dropper that paves the way for attackers to remotely steal data from Android phones has been spreading via nine malicious apps on the official Google Play store, according to researchers. The malware is part of a campaign aimed at lifting victims’ financial information, but which also...
Malware Can Exploit New Flaw in Intel CPUs to Launch Side-Channel Attacks
A new research has yielded yet another means to pilfer sensitive data by exploiting what's the first "on-chip, cross-core" side-channel attack targeting the ring interconnect used in Intel Coffee Lake and Skylake processors. Published by a group of academics from the University of Illinois at...
