Vulnerability of the software complex: Regional electronic budget. An integration platform related to deficiencies in the authentication mechanism, allowing a violator to determine whether a user with a specific login exists.

Vulnerability of the software complex: Regional electronic budget. The integration platform is linked to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to determine whether a user with a specific login exists...

Vulnerability of the software complex: Regional electronic budget. The integration platform, which is related to the shortcomings of the mechanism for limiting the number of authentication attempts, allows a violator to select a user password.

Vulnerability of the software complex: Regional electronic budget. The integration platform is connected to the shortcomings of the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability can allow a malicious actor to select a user password remotely...

A week in security (July 22 – 28)

Last week on Malwarebytes Labs, we offered an extensive analysis into the Malaysian Airlines Flight 17 investigation, updated users on the newest feature set to AdwCleaner 7.4.0 it now detects pre-installed software, and provided a deep dive into Phobos ransomware. We also broke down the latest...

Arbitrary File Download Vulnerability in Isthmus Electronic Document Security Management System (CNVD-2019-27482)

Electronic document security management system abbreviation: CDG is an electronic document security protection software. An arbitrary file read vulnerability exists in the IZP Electronic Document Security Management System. The download function somewhere in Yisetong Electronic Document Security...

SQL Injection Vulnerability in Electronic Tendering System of Gansu Chengxing Information Technology Co.

Gansu Chengxing Information Technology Co., Ltd. developed to meet the needs of various types of public resource transactions, can provide timely, reliable and effective support for the Chengxing public resource trading platform. Gansu Chengxing Information Technology Co., Ltd. electronic bidding...

SQL Injection Vulnerability in Electronic Service System V2.0 of Gansu Chengxing Information Technology Co.

Gansu Chengxing Information Technology Co., Ltd. developed to meet the needs of various types of public resource transactions, can provide timely, reliable and effective support for the Chengxing public resource trading platform. Gansu Chengxing Information Technology Co., Ltd. electronic service...

SQL Injection Vulnerability in Electronic Supervision System of Gansu Chengxing Information Technology Co.

Gansu Chengxing Information Technology Co., Ltd. developed to meet the needs of various types of public resource transactions, can provide timely, reliable and effective support for the Chengxing public resource trading platform. Gansu Chengxing Information Technology Co., Ltd. electronic...

DDoS Attacker Who Ruined Gamers' Christmas Gets 27 Months in Prison

A 23-year-old hacker from Utah who launched a series of DDoS attacks against multiple online services, websites, and online gaming companies between December 2013 and January 2014 has been sentenced to 27 months in prison. Austin Thompson, a.k.a. "DerpTroll," pledged guilty back in November 2018...

EA Origin Template Injection Remote Code Execution

Exploit Title: EA Origin 10.5.36 Template Injection Remote Code Execution Date: 04/19/2019 Exploit Author: Dominik Penner @zer0pwn Vendor Homepage: https://www.origin.com Software Link: https://www.origin.com/can/en-us/store/download Version: 10.5.36 and below Tested on: Windows 10 CVE :...

EA Games Patches Account-Hijacking Bug

Researchers chained together two vulnerabilities in the Electronic Arts EA gaming platform and developed a proof-of-concept attack that allowed for possible account takeovers. A successful attack could allow a malicious actor to gain access to a user’s account and steal credit card information or...

EA Origin < 10.5.38 - Remote Code Execution Vulnerability

Exploit Title: EA Origin 10.5.38 Remote Code Execution Date: 05/22/2019 Exploit Author: Dominik Penner @zer0pwn Vendor Homepage: https://www.origin.com Software Link: https://www.origin.com/can/en-us/store/download Version: 10.5.38 and below Tested on: Windows 7, Windows 8, Windows 10 CVE :...

EA Origin < 10.5.38 - Remote Code Execution

Exploit Title: EA Origin 10.5.38 Remote Code Execution Date: 05/22/2019 Exploit Author: Dominik Penner @zer0pwn Vendor Homepage: https://www.origin.com Software Link: https://www.origin.com/can/en-us/store/download Version: 10.5.38 and below Tested on: Windows 7, Windows 8, Windows 10 CVE :...

EA Origin 10.5.38 - Remote Code Execution

EA Origin 10.5.38 - Remote Code Execution Exploit Title: EA Origin 10.5.38 Remote Code Execution Date: 05/22/2019 Exploit Author: Dominik Penner @zer0pwn Vendor Homepage: https://www.origin.com Software Link: https://www.origin.com/can/en-us/store/download Version: 10.5.38 and below Tested on:...

Weak Password Vulnerability in Isthmus Electronic Document Security Management System

Electronic document security management system abbreviation: CDG is an electronic document security protection software. Document security management system there is a default password; attackers can log in through the default password to obtain sensitive information after the management of the...

Electronic Arts Origin URI Handler Remote Command Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Electronic Arts Origin. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within...

CVE-2019-12828

An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via t...

Design/Logic Flaw

An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via t...

CVE-2019-12828

An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via t...

CVE-2019-12828

CVE-2019-12828 affects Electronic Arts Origin prior to 10.5.39. The issue arises from improper sanitization of origin:// and origin2:// URI schemes, allowing injection of additional arguments into the Origin process and enabling remote code execution by loading a backdoored Qt plugin via the plat...

SQL Injection Vulnerability in Electronic Bidding and Trading Platforms

Jiangsu Guotai New Point Software Co., Ltd. is to provide e-government, public resources trading, electronic bidding, construction industry, smart city and other fields of related software products and hardware and software integration solutions. There is a SQL injection vulnerability in the...