GEOVAP Reliance 4 SCADA/HMI

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GEOVAP Equipment: Reliance 4 SCADA/HMI Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated attacker to use HTTP proxy...

Cross site scripting

Symantec Web Isolation WI 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious...

CVE-2018-12246

Symantec Web Isolation WI 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious...

CVE-2018-12246

Symantec Web Isolation WI 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious...

FTC Promotes International Charity Fraud Awareness Week

The Federal Trade Commission FTC has released an announcement promoting the first International Charity Fraud Awareness Week ICFAW. FTC, the National Association of State Charities Officials, and state and international partners coordinated this effort to raise awareness about donating wisely to...

Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-006) - Linux

Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

clc-engineering.com XSS vulnerability

Open Bug Bounty ID: OBB-688476 Description| Value ---|--- Affected Website:| clc-engineering.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

8 Popular Courses to Learn Ethical Hacking – 2018 Bundle

Update Oct 2018 — Over 30,000 students from all around the world have joined this training program so far. Due to the growing number of threats in the computer world, ethical hackers have become the most important player for not only governments but also private companies and IT firms in order to...

Information operations on Twitter: new data released on election tampering

Back in April, we talked about the wealth of options available to Russian hackers and others launching social engineering campaigns, whether on social networks or through clever attacks launched via Advanced Persistent Threats. Some of that was information published by Twitter at the time in...

It’s Everyone’s Job to Ensure Online Safety at Work

As part of our effort to support National Cyber Security Awareness Month I wanted to provide information on the need for everyone within a business to be aware of their role in keeping the organization safe from cyber attacks. Let’s discuss some of the areas where we see existing organizations...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.1, 15.2, 16.1, 16.2, 17.7 - 17.12 and 18.8. Easily exploitable vulnerability allows...

Code injection

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access v...

CVE-2018-3241

The CVE-2018-3241 issue affects Oracle Primavera P6 Enterprise Project Portfolio Management (P6 EPPM) Web Access. Affected are 8.4, 15.x, 16.x, 17.7–17.12, and 18.8 versions. The vulnerability is exploitable over HTTP by an unauthenticated remote attacker; however, user interaction is required fo...

CVE-2018-3148

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 15.1, 15.2, 16.1, 16.2, 17.1-17.12 and 18.1-18.8. Easily exploitable vulnerability allows unauthenticated attacker with network access v...

Reflected XSS Vulnerability in Web Isolation

SUMMARY Symantec Web Isolation WI is susceptible to a reflected cross-site scripting XSS vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript cod...

FBI Releases Article on Defending Against Payroll Phishing Scams

The Federal Bureau of Investigation FBI has released an article on building a digital defense against phishing scams targeting electronically deposited paychecks. In these schemes, scammers use phishing emails to direct employees to fraudulent websites and collect their work credentials. Scammers...

Octopus-infested seas of Central Asia

For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and...

focusengineering.nl XSS vulnerability

Open Bug Bounty ID: OBB-685583 Description| Value ---|--- Affected Website:| focusengineering.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Microsoft Zero-Day Patch for JET Bug Incomplete, Claims Firm

UPDATE Microsoft patched a zero-day in its JET Database Engine this week – but the patch was incomplete, according to researchers at 0patch. The company has developed a micropatch that corrects that hole, it said Friday. The memory corruption vulnerability CVE-2018-8423 could allow remote...