Permissive Cross-domain Policy With Untrusted Domains

sentry is susceptible to Permissive Cross-domain Policy With Untrusted Domains. If the Origin request header ends with the system.base-hostname option in the sentry installation, the sentry API returns the access-control-allow-credentials: true HTTP header. Only installations that have the...

USN-6225-1 knot-resolver vulnerability

It was discovered that Knot Resolver did not correctly handle certain client options. A remote attacker could send requests to malicous domains and cause a denial of service...

USN-6225-1: Knot Resolver vulnerability

It was discovered that Knot Resolver did not correctly handle certain client options. A remote attacker could send requests to malicous domains and cause a denial of service...

Vaidya-Mitra 1.0 SQL Injection

Title: Vaidya-Mitra 1.0 Multiple - SQLi Author: nu11secur1ty Date: 07.12.2023 Vendor: https://mayurik.com/ Software: free: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html, https://mayurik.com/source-code/P5890/best-hospital-management-system-in-php...

Storm-0978 attacks reveal financial and espionage motives

Microsoft has identified a phishing campaign conducted by the threat actor tracked as Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884, which included a remote code execution vulnerability exploited before disclosu...

The vulnerability of the cURL command-line utility relates to errors in the certificate validation process when substituting characters in TLS certificates for IDN names. This vulnerability allows a attacker to perform a “man-in-the-middle” attack.

The vulnerability of the cURL command-line utility is related to errors in the certificate validation process when comparing substitute characters in TLS certificates for IDN names. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

GHSA-MRR8-V49W-3333 sweetalert2 contains potentially undesirable behavior

sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

New Mozilla Feature Blocks Risky Add-Ons on Specific Websites to Safeguard User Security

Mozilla has announced that some add-ons may be blocked from running on certain sites as part of a new feature called Quarantined Domains. "We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including securi...

PT-2023-33044 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 11.6.14 and above Description: The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains TLDs. This...

Ericsson Network Manager 输入验证错误漏洞

Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. A security vulnerability exists in Ericsson Network Manager versions prior to 22.2, which stems from the presence of an open redirect...

go-restful: Authorization Bypass Through User-Controlled Key

A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data...

UPM Profile Gets Corrupt If Users With Same SAM Account Name In Different Domains Login

UPM profile gets corrupt if users with same SAM Account name in different domains login to the same VDA. Issue is seen with 1912 LTSR CU5 and above and 2203 LTSR CU1 and above. USER1.DomainA.com logson a VDA and then User1.DomainB.com logs on the same VDA then the local profile of user1.Domain A...

How to Split web traffic between Citrix Secure Web and native browser

By default, all Secure Mail generated web traffic is processed with Secure Web. If you prefer to split those web traffic between Secure Web and native browser, you maycreate a list of URLs typically, internal domains via configuring an MDX policy in the Citrix Endpoint Management console called...

New Horabot campaign targets the Americas

Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling "Horabot," which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020. The threat actor appears to be targetin...

PT-2023-13463 · Unknown · Shop Beat Media Player

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS vulnerabilities. These vulnerabilities can be exploited via the Shop Beat Control Panel, which is accessible at...

Mattermost 输入验证错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from Mattermost's failure to normalize UTF obfuscated characters when determining whether a preview should be generated for a...

PT-2023-21539 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to normalize UTF confusable characters when determining whether to generate a preview for a hyperlink. This allows an attacker to trigger a lin...

Phishing Domains Tanked After Meta Sued Freenom

The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta, which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while...

Interview With a Crypto Scam Investment Spammer

Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. What follows is an interview with a Russian hacker responsible for a series of aggressive crypto spam campaigns that recently prompted several...