GHSA-M6WH-M8M8-6XX5 cofeescript is malware

The cofeescript package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found cofeescript installed in your...

DOJ Nabs Three FIN7 Cybercrime Suspects in Europe

Three suspected members of the FIN7 cybercrime group have been arrested in Europe and accused of hacking more than 120 U.S.-based companies with the intent of stealing bank cards. In total, U.S. Department of Justice authorities said the FIN7 group — associated with the Carbanak crime gang — is...

Attacks on industrial enterprises using RMS and TeamViewer

Main facts Kaspersky Lab ICS CERT has identified a new wave of phishing emails with malicious attachments targeting primarily companies and organizations that are, in one way or another, associated with industrial production. The phishing emails are disguised as legitimate commercial offers and a...

CVE-2018-12942

SQL injection vulnerability in the "Users management" functionality in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows authenticated attackers to manipulate an SQL query within the application by sending additional SQL commands to the application server. An attacker can use this...

The first Spark REST API is not authorized to exploit analysis-exploit warning-the black bar safety net

2018 7 on 7 May, Ali Cloud Security for the first time to capture the Spark REST API unauthorized RCE vulnerability to attack of real samples. 7 on number 9 plays, Ali Cloud Platform has been able to the default of Defense the vulnerability of the large-scale use. This is the first time in...

NetSpectre — New Remote Spectre Attack Steals Data Over the Network

A team of security researchers has discovered a new Spectre attack that can be launched over the network, unlike all other Spectre variants that require some form of local code execution on the target system. Dubbed "NetSpectre," the new remote side-channel attack, which is related to Spectre...

iPhone Hacking Campaign Using MDM Software Is Broader Than Previously Known

India-linked highly targeted mobile malware campaign, first unveiled two weeks ago, has been found to be part of a broader campaign targeting multiple platforms, including windows devices and possibly Android as well. As reported in our previous article, earlier this month researchers at Talos...

IoT Robot Vacuum Vulnerabilities Let Hackers Spy on Victims

UPDATE Researchers have uncovered vulnerabilities in a connected vacuum cleaner lineup that could allow attackers to eavesdrop, perform video surveillance and steal private data from victims. Two vulnerabilities were discovered in Dongguan Diqee 360 vacuum cleaners, which tout Wi-Fi capabilities,...

EU Cybersecurity Act IoT FAIL

The EU recently announced that its plans for a Cybersecurity Act had been backed by industry committee MEPs. This was a significant opportunity for consumer IoT security to be regulated and resolve the current mess. Sadly, they’ve stopped short and made the code voluntary for all but certain...

Online generators… of dashed expectations

Quite recently, we and hence our security solutions started to designate an entire class of sites — gift card generators — as fraudulent, despite their not stealing any money or personal data from visitors. Why? Let's try to unpick these sites and see how they work. How it works Ads for all kinds...

21-Year-Old Woman Charged With Hacking Selena Gomez's Email Account

A 21-year-old New Jersey woman has been charged with hacking into the email accounts of pop star and actress Selena Gomez, stealing her personal photos, and then leaked them to the Internet. Susan Atrach of Ridgefield Park was charged Thursday with 11 felony counts—five counts of identity theft,...

Installing a Credit Card Skimmer on a POS Terminal

Watch how someone installs a credit card skimmer in just a couple of seconds. I don't know if the skimmer just records the data and is collected later, or if it transmits the data back to some base station...

A highly targeted malware campaign is spying on 13 iPhones in India

By Waqas A dangerous targeted mobile malware campaign has been identified by security researchers, which is believed to have been active since August 2015. Researchers claim that the malware is discovered to be spying on 13 specific iPhones in India, which hints at the fact that this is a highly...

XXE Vulnerability in JAVA SDK for Third-Party Payment Platforms

The third-party payment platform is an independent organization with certain strength and credibility guarantee, which adopts the way of contracting with major banks to provide a transaction support platform with the interface of the bank's payment and settlement system as the network payment mod...

Casper: Mixed content issues on the site https://casper.com

Hello. While browsing the site https://casper.com found a mixed content error on the site with HTTPS. This error is located at https://casper.com/faqs/resources/the-best-positions-for-sleeping/. 8 images are uploaded to the site via HTTP. What warns the browser Google Chrome. F314123 Impact If th...

Multiple Vulnerabilities in Healwire Online Pharmacy

Healwire is an online medical drugstore run by Webandcrafts personal web pages utilizing the Laravel framework 4.2. A cross-site scripting and cross-site request forgery vulnerability exists in Healwire Online Pharmacy. An attacker could use this vulnerability to steal user information and take...

Multiple Vulnerabilities in SuperCom Online Shopping Ecommerce Cart

SuperCom Online Shopping Ecommerce Cart is a web-based apparel sales platform with a user-friendly interface. The vulnerabilities in SuperCom Online Shopping Ecommerce Cart include stored cross-site scripting, cross-site request forgery, and authentication bypass, which can be exploited by...

priorityhondaofhuntersville.financing.dealer.com XSS vulnerability

Open Bug Bounty ID: OBB-632244 Description| Value ---|--- Affected Website:| priorityhondaofhuntersville.financing.dealer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79...

Chinese Hackers Carried Out Country-Level Watering Hole Attack

Cybersecurity researchers have uncovered an espionage campaign that has targeted a national data center of an unnamed central Asian country in order to conduct watering hole attacks. The campaign is believed to be active covertly since fall 2017 but was spotted in March by security researchers fr...

SAP Hana DB, UI5 and UI Cross-Site Scripting Vulnerabilities

SAP Hana DB, UI5, and UI are products of SAP, an in-memory database based on rows and columns.UI5 and UI are JavaScript-based UI libraries that integrate a large number of UI controls. A security vulnerability exists in SAP Hana DB, UI5, and UI that stems from the program's failure to validate us...