Into the Breach: Breaking Down 3 SaaS App Cyber Attacks in 2022

During the last week of March, three major tech companies - Microsoft, Okta, and HubSpot - reported significant data breaches. DEV-0537, also known as LAPSUS$, performed the first two. This highly sophisticated group utilizes state-of-the-art attack vectors to great success. Meanwhile, the group...

Design/Logic Flaw

In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. Thi...

CVE-2021-43437

Technical details, affected versions, exploit methods, and fixes for CVE-2021-43437 are not publicly provided in the supplied documents; monitor official advisories for updates.

Employees Daily Task Management System 1.0 SQL Injection

Exploit Title: Employees Daily Task Management System 1.0 - 'username' SQLi Authentication Bypass Exploit Author: able403 Date: 08/12/2021 Vendor Homepage: https://www.sourcecodester.com/php/15030/employee-daily-task-management-system-php-and-sqlite-source-code.html Software Link:...

Intel Is Maintaining Legacy Technology for Security Research

Interesting: Intel’s issue reflects a wider concern: Legacy technology can introduce cybersecurity weaknesses. Tech makers constantly improve their products to take advantage of speed and power increases, but customers don’t always upgrade at the same pace. This creates a long tail of old product...

How Red Canary and Microsoft can help reduce your alert fatigue

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Security alert fatigue Organizations often feel overwhelmed by the number of security alerts they receive. Frustrated by alert fatigue, these organizations want a deeper understandin...

Join us at InfoSec Jupyterthon 2021

We’re excited to invite our community of infosec analysts and engineers to the second annual InfoSec Jupyterthon taking place on December 2-3, 2021. This is an online event organized by our friends in the Open Threat Research Forge, together with folks from the Microsoft Threat Intelligence Cente...

Sourcecodester Engineers Online Portal SQL Injection Vulnerability (CNVD-2021-99654)

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection. An attacker can exploit the vulnerability to extract sensitive data from the web server via the id parameter of quizquestion.php and, in some cases...

Sourcecodester Engineers Online Portal SQL Injection Vulnerability (CNVD-2021-99650)

Sourcecodester Engineers Online Portal is an open source online portal. Sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to extract sensitive data from the web server via the announcesstudent.php id parameter of announcesstudent.php...

Sourcecodester Engineers Online Portal SQL Injection Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. Sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to bypass authentication via the login form in index.php...

Sourcecodester Engineers Online Portal Access Control Error Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. niamunozmonitoringsystem/admin/uploads of Sourcecodester Engineers Online Portal in PHP is vulnerable to An access control error vulnerability can be exploited to bypass access control and access all files uploaded to the web...

Sourcecodester Engineers Online Portal Arbitrary File Upload Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to arbitrary file uploads, which can be exploited by attackers to execute commands on a web server...

Sourcecodester Engineers Online Portal SQL Injection Vulnerability (CNVD-2021-99652)

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to extract sensitive data from the Web server via the id parameter of myclassmates.php, and in some cases...

Sourcecodester Engineers Online Portal Cross-Site Scripting Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to run javascript commands via the addquiz.php quiz title and quiz description...

CVE-2021-42669

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

CVE-2021-42671

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

CVE-2021-42670

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcementsstudent.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code...

CVE-2021-42668

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the myclassmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code executio...

CVE-2021-42665

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42666

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quizquestion.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remot...