3168 matches found
Zoho ManageEngine ADManager Plus路径遍历漏洞
ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and help desk technicians with day-to-day administrative tasks such as bulk management of user accoun...
Tips & Tricks for Unmasking Ghoulish API Behavior
I was analyzing one of my customer’s API traffic the other day and I noticed something odd about the devices that were using the mobile application API. I found standard browsers like Firefox and Chrome hitting API endpoints that should only be touched by their mobile-application communication. I...
ZOHO ManageEngine ADManager Plus Code Execution Vulnerability
ZOHO ManageEngine ADManager Plus is a Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and help desk technicians with day-to-day administrative tasks, such as bulk management of user accounts and A...
ZOHO ManageEngine ADManager Plus File Upload Vulnerability
ZOHO ManageEngine ADManager Plus is a set of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. ZOHO ManageEngine ADManager Plus is a file upload vulnerability that can be exploited by attackers to cause remote code execution...
ABB Mybuildings 代码问题漏洞
ABB Mybuildings is an innovative solution for smart home systems from ABB Switzerland. A code issue vulnerability exists in ABB Mybuildings that stems from the product allowing the virtual transfer of devices to my.busch-jaeger.de or mybuildings.abb.com by entering a serial number, which can be...
Exchange/Outlook Autodiscover Bug Spills $100K+ Email Passwords
Guardicore security researcher Amit Serper has discovered a severe design bug in Microsoft Exchange’s autodiscover – a protocol that lets users easily configure applications such as Microsoft Outlook with just email addresses and passwords. The flaw has caused the Autodiscover service to leak...
Microsoft Exchange Bug Exposes ~100,000 Windows Domain Credentials
An unpatched design flaw in the implementation of Microsoft Exchange's Autodiscover protocol has resulted in the leak of approximately 100,000 login names and passwords for Windows domains worldwide. "This is a severe security issue, since if an attacker can control such domains or has the abilit...
Domain Brand Monitor by WhoisXML API: The First Layer of Protection against Brand Impersonators
An alarming 32% of sample domains containing the names of the 10 most-impersonated brands have been found malicious by WhoisXML API researchers. The volume was based on a sample comprising 12,000 possible typosquatting domains and subdomains that made their way into the Domain Name System DNS...
Anonymous steals ‘decade’s worth of data’ from far-right web host Epik
By Waqas Anonymous claims the data contains information about Epik domains, clients, and even backend information of the company’s clients to the public. This is a post from HackRead.com Read the original post: Anonymous steals decade’s worth of data from far-right web host Epik...
Operation ‘Harvest’: A Deep Dive into a Long-term Campaign
ARCHIVED STORY Operation ‘Harvest’: A Deep Dive into a Long-term Campaign By Christiaan Beek · September 14, 2021 A special thanks to our Professional Services’ IR team,ShadowServer, for historical context on C2 domains, and Thomas Roccia/Leandro Velasco for malware analysis support. Executive...
Fortinet FortiManager Licensing Issue Vulnerability
Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...
Denial Of Service (DoS)
xen/arm is vulnerable to denial of service. No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the memory limit from them is not set. This allow a domain to allocate memory beyond what an...
Chinese Authorities Arrest Hackers Behind Mozi IoT Botnet Attacks
The operators of the Mozi IoT botnet have been taken into custody by Chinese law enforcement authorities, nearly two years after the malware emerged on the threat landscape in September 2019. News of the arrest, which originally happened in June, was disclosed by researchers from Netlab, the...
GHSA-9GR3-7897-PP7M XSS in Image Optimization API for Next.js
Impact - Affected: All of the following must be true to be affected - Next.js between version 10.0.0 and 11.1.0 - The next.config.js file has images.domains array assigned - The image host assigned in images.domains allows user-provided SVG - Not affected: The next.config.js file has images.loade...
CVE-2021-22929
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log...
CVE-2021-22929
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log...
Information disclosure
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log...
CVE-2021-22929
An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log...
