BlackCat CMS 1.3.6 - (Multiple) Stored Cross-Site Scripting (XSS) Vulnerability

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Date: 04/07/2021 Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

CVE-2021-30496

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service application crash if the victim pastes an attacker-supplied message e.g., in the Persian language into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that...

Carbanak and FIN7 Attack Techniques

What happens in Carbanak and FIN7 attacks? Here are some techniques used by these financially motivated threat groups that target banks, retail stores, and other establishments...

The Storybook Approach to MITRE ATT&CK

Read this year’s MITRE Engenuity ATT Evaluations story, which simulates techniques associated with notorious threat groups Carbanak and FIN7 to test solutions' ability to detect and stop APT & Targeted Attacks...

Virtuozzo Hybrid Infrastructure 4.5 Update 1 Hotfix 2 (4.5.1-34)

This update provides fixes for the admin and self-service panels. Vulnerability id: VSTOR-42074 Unable to add a network interface to an existing VM in the self-service panel. Vulnerability id: VSTOR-42954 Added a message about disabling security groups for a VM network interface. Vulnerability id...

SUSE: Security Advisory (SUSE-SU-2015:0281-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Atlassian Jira Server and Data Center Information Disclosure Vulnerability (CNVD-2021-55945)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA. Atlassian Jira Server and Data Center have an...

openSUSE: Security Advisory for chromium (openSUSE-SU-2021:0436-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Attackers Target ProxyLogon Exploit to Install Cryptojacker

Cryptojacking can be added to the list of threats that face any unpatched Exchange servers that remain vulnerable to the now-infamous ProxyLogon exploit, new research has found. Researchers discovered the threat actors using Exchange servers compromised using the highly publicized exploit...

GHSA-JRH7-MHHX-6H88 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

Impact Missing input validation of some parameters on the groups also known as communities endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields. Patches This issue is fixed by 9321 and 9393...

Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints

Impact Missing input validation of some parameters on the groups also known as communities endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields. Patches This issue is fixed by 9321 and 9393...

PT-2021-14558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java HTTP Service versions 7.10 through 7.50 Description The issue arises from insufficient validation of logon groups in URLs, leading to a content spoofing issue when directory listing is enabled...

PYSEC-2021-27

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party...

Man Arrested for AWS Bomb Plot

A Texas man has been charged with plotting a bombing of Amazon Web Services in a quest to allegedly “kill off the internet.” Seth Aaron Pendley was arrested in Ft. Worth after allegedly attempting to get an explosive device from an undercover FBI employee in a sting. The feds were alerted to...

PT-2021-4612

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.212 Description The issue is related to an out of bounds read in Tab Groups, which allowed an attacker to perform an out of bounds memory read via a crafted HTML page if a user was convinced to install...

CVE-2021-28924

Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page...

CVE-2021-28924

Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page...

CVE-2021-28924: Improper Neutralization of Input During Web Page Generation

Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page...

PT-2021-17986

Name of the Vulnerable Software and Affected Versions: Nagios Network Analyzer versions prior to 2.4.2 Description: The issue concerns a Self Authenticated XSS in the nagiosna/groups/queries page. Recommendations: For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue...