6488 matches found
Cross site scripting
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure -- user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data...
CVE-2020-11822
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure -- user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data...
JVN#35649781: Multiple vulnerabilities in Cybozu Garoon
Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Authentication bypass in the API used to specify the fields CWE-287 - CVE-2020-5563 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 5.3 CVSS v2|...
SQL Injection Vulnerability in zh***.php Page of Huaxia Chemical Website Builder System
Huaxia chemical network is by Shanghai Danfan network technology limited company founded, is for the chemical industry to provide security, high efficiency, multi-function, system supporting B2B electronic commerce platform of professional website. There is a SQL injection vulnerability in zh.php...
Maze Ransomware Attack Hits Cognizant
IT services giant Cognizant said that it has been hit by the Maze ransomware group in a cyberattack that has caused service disruptions. Cognizant, a Fortune 500 company that employs close to 300,000 people, said that it is providing customers with indicators of compromise IoCs and other technica...
COVID-Themed Lures Target SCADA Sectors With Data Stealing Malware
A new malware campaign has been found using coronavirus-themed lures to strike government and energy sectors in Azerbaijan with remote access trojans RAT capable of exfiltrating sensitive documents, keystrokes, passwords, and even images from the webcam. The targeted attacks employ Microsoft Word...
The vulnerability of the libseccomp library lies in its lack of access control for certain functions. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the libseccomp library is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failures...
CVE-2020-11813
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...
CVE-2020-11813
CVE-2020-11813: In Rukovoditel 2.5.2, a stored XSS exists on the configuration page via the copyright text input, causing injected scripts to potentially steal user data since the copyright text appears on every page. The vulnerability is triggered by unsanitized input in a client-side field; doc...
chromium-browser: Inappropriate implementation in extensions
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...
Ransomware Now Leaking Stolen Documents
Originally, ransomware didn't involve any data theft. Malware would encrypt the data on your computer, and demand a ransom for the encryption key. Now ransomware is increasingly involving both encryption and exfiltration. Brian Krebs wrote about this in December. It's a further incentive for the...
DEBIAN-CVE-2020-6440
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...
Design/Logic Flaw
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...
UBUNTU-CVE-2020-6440
Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...
Information Disclosure
firefox is vulnerable to information disclosure. The vulnerability exists as an attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim has loaded with Firefox...
Information Disclosure
firefox is vulnerable to information disclosure. The vulnerability exists as an attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim has loaded with Firefox...
Denial Of Service (DoS)
Mozilla Firefox is vulnerable to denial of service DoS. A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as user names and passwords...
Phishing Attacks
firefox is vulnerable to phishing attacks. The vulnerability exists as a web page containing malicious content could execute arbitrary JavaScript in the context of the site, possibly presenting misleading data to a user, or stealing sensitive information such as login credentials...
7 Ways Hackers and Scammers Are Exploiting Coronavirus Panic
In our previous stories, you might have already read about various campaigns warning how threat actors are capitalizing on the ongoing coronavirus pandemic in an attempt to infect your computers and mobile devices with malware or scam you out of your money. Unfortunately, to some extent, it's...
CVE-2018-18494
A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...