Finance Says - SQL Injection Vulnerability in Cloud Live Streaming Software

Financial Saying Cloud Live software is an online live chat software system developed for the financial industry orientation. Finance Says Cloud Live Software has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

london-finance-fair.event.essec.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1006773 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Cross site scripting

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

CVE-2019-17551

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

CVE-2019-17551

CVE-2019-17551 affects Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5. An attacker can send an authenticated POST to /WFS/agreementView.faces to trigger a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text field in the Notes section. The issue is tied to the WYSIW...

PT-2019-15201

Name of the Vulnerable Software and Affected Versions Apak Wholesale Floorplanning Finance versions 6.31.8.3 through 6.31.8.5 Description The issue allows an attacker to send an authenticated POST request with a malicious payload to "/WFS/agreementView.faces" which enables a stored XSS via the...

CVE-2019-17551: Improper Neutralization of Input During Web Page Generation

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:richtexteditornotetext parameter in the Notes section. Although versions...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30452)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.3. The vulnerability stems from a lack of filtering of user-supplied data in the asset account name field. An attacker can exploit the vulnerability t...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30779)

Firefly III is an open source personal financial management system. A cross-site scripting vulnerability exists in Firefly III versions prior to 4.7.17.3, which can be exploited by an attacker to execute client-side code...

FEC: Campaigns Can Use Discounted Cybersecurity Services

The U.S. Federal Election Commission FEC said today political campaigns can accept discounted cybersecurity services from companies without running afoul of existing campaign finance laws, provided those companies already do the same for other non-political entities. The decision comes amid much...

Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms

An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known as APT33, which Symantec...

financingtips.net XSS vulnerability

Open Bug Bounty ID: OBB-709767 Description| Value ---|--- Affected Website:| financingtips.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

ThreatList: 3 Out of 4 Employees Pose a Security Risk to Businesses

While much is always made of external hackers, insider threats remain a problem at more organizations. A full 75 percent of professionals pose a moderate or severe risk to their company’s data, according to a recent survey. MediaPRO’s third-annual State of Privacy and Security Awareness Report...

National Cybersecurity Awareness Month: Critical Infrastructure Cybersecurity

October is National Cybersecurity Awareness Month, an annual campaign to raise awareness about cybersecurity. Building resilience in critical infrastructure is crucial to national security. The essential infrastructure systems that support our daily lives—such as electricity, financial...

calvertonfinance.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-685027 Description| Value ---|--- Affected Website:| calvertonfinance.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

A week in security (September 17 – 23)

Last week, we took a look at a low level spam campaign on Twitter, explored the signs of falling victim to phishing, and examined a massive WordPress compromise. We also explained some SASL vulnerabilities and covered a breaking Emotet spam campaign. Other cybersecurity news: NewEgg attacked by...

finance-commerce.com XSS vulnerability

Open Bug Bounty ID: OBB-642374 Description| Value ---|--- Affected Website:| finance-commerce.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Hidden Cobra Strikes Again with Custom RAT, SMB Malware

The feds are warning that the North Korean APT group known as Hidden Cobra is mounting active attacks on U.S. businesses and others globally, including organizations in the media, aerospace, financial and critical infrastructure sectors. According to a United States Computer Emergency Readiness...

FBI issues alert over two new malware linked to Hidden Cobra hackers

The US-CERT has released a joint technical alert from the DHS and the FBI, warning about two newly identified malware being used by the prolific North Korean APT hacking group known as Hidden Cobra. Hidden Cobra, often known as Lazarus Group and Guardians of Peace, is believed to be backed by the...

finance-commerce.com XSS vulnerability

Open Bug Bounty ID: OBB-620300 Description| Value ---|--- Affected Website:| finance-commerce.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...