HackerOne: HTML injection can lead to data theft

Hey, This is more like an in-depth security thing with a reasonable attack scenario. In some occasions, it seems to be possible to leak sensitive data to an external server, not affected by the CSP. This can happen in the following situation: 1. There's a HTML injection vulnerability 2. The...

SAP HANA 4 Cross Site Scripting

SAP Hana Cloud Platform Cockpit Cross site Scripting Vulnerabilities ======================================================================== Vender: SAP Product: SAP HANA CLoud Vulnerability Type: Cross site scripting Title: SAP Hana Cloud Cross scripting in User Display Name Details: SAP Hana...

D-Link Webcam Hack Turns IoT Device into Backdoor

Connecting a webcam to your home or office network might seem like a harmless thing, but researchers have figured out how to turn that connected device into a backdoor. Researchers at Vectra Networks today released a report demonstrating how a $30 D-Link webcam can be abused by attackers and turn...

CentOS Update for thunderbird CESA-2016:0001 centos5

Check the version of thunderbird SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882354";...

ASUS Japan WL-330NUL Device Cross-Site Scripting Vulnerability

The ASUS Japan WL-330NUL is a portable wireless LAN router from ASUS. The ASUS Japan WL-330NUL suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

Google browser plug-in AVG Web TuneUp aeration multiple high-risk vulnerabilities, affect 9 0 0 million users-vulnerability warning-the black bar safety net

This year 8 month 1 5 days, from project zero members Tavis submit a Google browser plug-in AVG Web TuneUp multiple vulnerabilities, since the plug-in active users of about 9 0 0 million, so the impact range is very wide. This plugin adds a lot of api used to operate Google Chrome, for example, c...

The vulnerability of the Firefox browser allows attackers to obtain confidential information, increase their privileges, or perform XSS attacks.

The vulnerability of Firefox browsers is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to enhance their privileges, carry out XSS attacks, or potentially obtain confidential information through a specially crafted website...

CVE-2015-7932

Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network...

dmv.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-119151 Description| Value ---|--- Affected Website:| dmv.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable URL...

TYPO3 'typoLink()' function cross-site scripting vulnerability

TYPO3 is a free and open source content management system. TYPO3 suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

SlemBunk: An Evolving Android Trojan Family Targeting Users of Worldwide Banking Apps

FireEye mobile researchers recently identified a series of Android trojan apps that are designed to imitate the legitimate apps of 33 financial management institutions and service providers across the globe. We dub the family “SlemBunk,” and have seen it covering three major continents: North...

Belkin N150 Wireless Home Router Session Hijacking Vulnerability

Belkin N150 Wireless Home is a wireless router product from Belkin USA. A session hijacking vulnerability exists in the Belkin N150 Wireless Home Router, which could be exploited by an attacker to hijack a user session and obtain sensitive information...

Instacart: Cookie-Based Injection

Hi Security Team instacart I'm Found Vulnerability Cookie-Based Injection It's may be possible to steal or manipulate session and cookies if attacker can injection XSS . details --- in path /help/ contain header in cookie paramter ahoyvisitor and ahoyvisit it's allow injection because re request...

Same-origin policy violation using performance.getEntries and history navigation — Mozilla

Security researcher cgvwzq reported that it is possible to read cross-origin URLs following a redirect if performance.getEntries is used along with an iframe to host a page. Navigating back in history through script, content is pulled from the browser cache for the redirected location instead of...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2015-08136)

IBM WebSphere Portal is a suite of enterprise portal software from IBM in the United States. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...

Spy Banker Banking Malware Hosted on Google Cloud Server

A new run of Spy Banker banking malware infections has been targeting Portuguese-speaking victims in Brazil. While Spy Banker is an old threat, dating back to 2009 according to some security companies, the latest wrinkle attackers are taking is a new one. The campaign, spotted by researchers at...

Microsoft Internet Explorer XSS Filter CVE-2015-6138 Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. They can then execute arbitrary script code in the context of th...

ALERT: This New Ransomware Steals Passwords Before Encrypting Files

You should be very careful while visiting websites on the Internet because you could be hit by a new upgrade to the World's worst Exploit Kit – Angler, which lets hackers develop and conduct their own drive-by attacks on visitors' computers with relative ease. Many poorly-secured websites are...

54 Starwood Hotels Hit By Point of Sale Malware

Travelers who stayed at either a Westin, Sheraton, or W hotel over the last year or so are going to want to check their bank statements sooner rather than later. Starwood Hotels and Resorts, a company that owns and operates approximately 1,200 hotels across North America, including the...

Moodle cross-site scripting vulnerability (CNVD-2015-07727)

Moodle is a free, open source e-learning software platform. Moodle suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...