Security Bulletin: IBM Cloud Functions is affected by two function runtimevulnerabilities

Summary IBM Cloud Functions has addressed the following vulnerabilities. Users of the IBM Cloud Functions service that are using docker actions https://console.bluemix.net/docs/openwhisk/openwhiskactions.htmlcreating-docker-actions are affected but only if the user's function has a general securi...

Shopify: App messaging can be hijacked by third-party websites

The JavaScript code at https://cdn.shopify.com/s/assets/admin/index-c6e72fa910cd0182ab1d1e67ff823fb2e6ca61745c00797769410ce01aafc4d8.js installs a message event listener to receive messages from installed apps when these apps are displayed in a frame. The following check rejects invalid event...

Introducing: Malwarebytes Browser Extension

Are you tired of all the unwanted content the world wide web offers up, whether you like it or not? It is our privilege to introduce you to the Malwarebytes Browser Extension BETA. Or, better said, the Malwarebytes Browser Extensions, because we have one for Firefox and one for Chrome. Introducti...

Trojans: What’s the real deal?

The fictional Greeks hiding in their legendary Trojan horse would probably be excited to learn that the default Wiki page for Trojan is, in fact, their big wooden horse thingy vs. computer infections or dubious businesses. Sorry, fictional ancient Greek warriors. It’s not that we don't think you'...

Shopclues.com Cross Site Request Forgery

Exploit Title: Cross-Site Request Forgery CSRF at SHOPCLUES Date: 17.07.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.shopclues.com/ Software Type : Website Software Version : N/A Vulenrability : Cross-Site Request Forgery CSRF Risk : Medium Description : What is Cross-Site...

Vanilla: Bypassing the Trusted Link Alert System

Summary: I have discovered a means of bypassing the system that will alert users of an untrusted link utilizing the Right to Left Overrride unicode character. The alert looks like this: https://i.imgur.com/9rp1K7b.mp4 Description: For this demonstration, I have added "facebook.com" to the trusted...

Camelishing - Social Engineering Tool

Camelishing Social Engineering Tool Features 1. Bulk email sending 2. Basic Python Agent Creator 3. Office Excel Macro Creator 4. DDE Excel Creatoror Custom Payload 5. Return İnformation Mail Open Track Agent Open Track 6. AutoSave 7. Statistics Report 8. User Control Installation Modules $ pip...

Imgur: Go.imgur.com can be used to phish for account information

Right now the go.imgur.com domain is pointing to godoc.org/go.imgur.com but there is nothing at this resource. It is possible with encoded double dots to redirect go.imgur.com URLs to pages that phish for imgur account information. Proof of Concept === PoC 1:...

CVE-2018-2969

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successfu...

CVE-2018-2966

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. Supported versions that are affected are 16.x, 17.x and 18.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera...

CVE-2018-2963

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x and 16.x. Easily exploitable vulnerability allows low privileged attacker with network acce...

CVE-2018-2967

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. Supported versions that are affected are 16.x, 17.x and 18.x. Easily exploitable vulnerability allows physical access to compromise Primavera Unifier. While the vulnerability is in...

CVE-2018-2969

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successfu...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Difficult to exploit vulnerability allows low privileged attacker with...

Design/Logic Flaw

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successfu...

Design/Logic Flaw

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x and 16.x. Easily exploitable vulnerability allows low privileged attacker with network acce...

Design/Logic Flaw

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successf...

CVE-2018-2963

CVE-2018-2963 affects Oracle Primavera P6 Enterprise Project Portfolio Management (P6 EPPM) Web Access; affected versions are 8.4, 15.x and 16.x. The vulnerability enables a low-privileged, network-remote attacker (via HTTP) to read a subset of data from P6 EPPM. The available documents do not sp...

CVE-2018-2965

CVE-2018-2965 affects Oracle Primavera Unifier Core (Oracle Construction and Engineering Suite) as part of the 16.x line. The vulnerability is described as unauthenticated remote access over HTTP that allows an attacker to compromise Primavera Unifier, with human interaction required. Consequence...

CVE-2018-2963

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x and 16.x. Easily exploitable vulnerability allows low privileged attacker with network acce...