U.S. Finance Sector Hit with Targeted Backdoor Campaign

The financial services sector in the U.S. found itself under a barrage of cyberattacks last month, all bent on delivering a powerful backdoor called Minebridge. The attack chain employed a known method called “VBA Stomping” to avoid detection. According to researchers at FireEye, the campaigns,...

Centreon 19.10.5 Remote Command Execution

Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7.7 CVE : - Centreon 19.10.5 Remote Comma...

Centreon 19.10.5 - Pollers Remote Command Execution

Centreon 19.10.5 - Pollers Remote Command Execution Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested...

Centreon 19.10.5 - 'Pollers' Remote Command Execution

Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7.7 CVE : - Centreon 19.10.5 Remote Comma...

Centreon 19.10.5 Remote Command Execution

Exploit Title: Centreon 19.10.5 - Remote Command Execution Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri BASO Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE : - Centreon 19.10.5 Remote Command Execution...

Centreon 19.10.5 - Database Credentials Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE :...

Centreon 19.10.5 - Database Credentials Disclosure

Centreon 19.10.5 - Database Credentials Disclosure Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on:...

Centreon 19.10.5 - Database Credentials Disclosure

Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri Baso Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE : - Centreon 19.10.5 Database...

sp-finance.e-monsite.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1055195 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting sp-finance.e-monsite.com...

Download: The 2020 Cybersecurity Salary Survey Results

The 2020 Cybersecurity Salary Survey was an online survey published to gain insight into the details related to cybersecurity compensation. It was completed by over 1,500 security professional respondents. Today you can access the aggregated and analyzed 2020 Cybersecurity Salary Survey Results a...

Finance Says - SQL Injection Vulnerability in Cloud Live Streaming Software

Financial Saying Cloud Live software is an online live chat software system developed for the financial industry orientation. Finance Says Cloud Live Software has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

Unspecified vulnerability in SAP Treasury and Risk Management

SAP Treasury and Risk Management TRM is a finance and risk management solution from SAP. The product is primarily used to analyze and optimize business processes in the area of corporate finance. A security vulnerability exists in SAP TRM, which stems from a lack of authorization checks in the...

london-finance-fair.event.essec.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1006773 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Cross site scripting

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

CVE-2019-17551

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

CVE-2019-17551

CVE-2019-17551 affects Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5. An attacker can send an authenticated POST to /WFS/agreementView.faces to trigger a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text field in the Notes section. The issue is tied to the WYSIW...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30452)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.3. The vulnerability stems from a lack of filtering of user-supplied data in the asset account name field. An attacker can exploit the vulnerability t...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30779)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

FEC: Campaigns Can Use Discounted Cybersecurity Services

The U.S. Federal Election Commission FEC said today political campaigns can accept discounted cybersecurity services from companies without running afoul of existing campaign finance laws, provided those companies already do the same for other non-political entities. The decision comes amid much...

Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms

An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known as APT33, which Symantec...