Google Play Bitten by Sharkbot Info-stealer ‘AV Solution’

Researchers have found the info-stealing Android malware Sharkbot lurking unsuspected in the depths of the Google Play store under the cover of anti-virus AV solutions. While analyzing suspicious applications on the store, the Check Point Research CPR team found what purported to be genuine AV...

Octosuite - Advanced Github OSINT Framework

Simply gatherOSINT on Github users and organizations like a god  FEATURES Fetches organization info Fetches user info Fetches repository info Returns contents of a path from a repository Returns a list of repos owned by an organization Returns a list of repos owned by a user Returns a list of...

info-svet.ru Cross Site Scripting vulnerability OBB-2477237

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-27819

SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service memory exhaustion upon an attempt to parse a large or infinite file such as a block or character device...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfstargetidswrite' CVE-2021-46937 In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: protect targets destructions with kdamondlock...

Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info

Attackers are spoofing voice message notifications from WhatsApp in a malicious phishing campaign that uses a legitimate domain to spread an info-stealing malware, researchers have found. Researchers at cloud email security firm Armorblox discovered the malicious campaign targeting Office 365 and...

IBM Sterling Partner Engagement Manager信息泄露漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from IBM Corporation. IBM Sterling Partner Engagement Manager version 6.2.0 is vulnerable to an information disclosure vulnerability that could be exploited by a remote, authenticated attacker to obtain sensitive information ...

CVE-2022-23698

The CVE-2022-23698 issue affects HPE OneView prior to version 6.6. It is a remote, unauthenticated information-disclosure vulnerability in OneView (information leakage). The available sources state that HPE has provided a software update to resolve the vulnerability, with no exploitation details ...

BlackGuard Password Stealing Malware Being Sold on Russian Hacking Forums

By Deeba Ahmed Zscaler ThreatLabz researchers have discovered sophisticated new info stealing malware available as malware-as-a-service on Russian hacking forums. In… This is a post from HackRead.com Read the original post: BlackGuard Password Stealing Malware Being Sold on Russian Hacking Forums...

CVE-2022-1026

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function...

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File

Description Formula Injection/CSV Injection in "Firstname" & "Lastname" due to Improper Neutralization of Formula Elements in CSV File. Proof of Concept 1.Go to a Preferences from the user account and in Personal info of "Firstname" & "Lastname" insert the below payloads. 2.Payloads:-...

PUB-A-216607118

In exception handling functions of multiple files, there is a possible info leak due to side channel information disclosure. This could lead to local information disclosure from the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-8020

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the deletion of routes with nexthop objects. The issue occurs when trying to delete a route pointing to a nexthop id...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26644

The CVE-2022-26644 entry concerns Online Banking System Protect v1.0 with multiple cross-site scripting (XSS) flaws exploitable through parameters on user profile, system_info, and accounts management. This is documented across multiple sources (NVD/Red Hat and PT Security). Root cause is XSS in ...

CVE-2021-39740

In Messaging, there is a possible way to bypass attachment restrictions due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID...

Input validation

In Telecomm, there is a possible way to determine whether an app is installed, without query permissions, due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39781

CVE-2021-39781 affects Android 12L with a vulnerability in SmsController permitting information disclosure via a permissions bypass, enabling local escalation of privilege and SMS sending without extra privileges. The issue is documented in Android 12L security release notes; mitigation is provid...

CVE-2021-39757

CVE-2021-39757 affects Android 12L with a permission bypass in the PermissionController caused by unsafe PendingIntent, enabling local information disclosure. Exploitation requires low privileges and no user interaction, with potential access to sensitive data on the device as described in multip...

CVE-2021-39739

CVE-2021-39739 affects Android 12L and is a vulnerability in the ArrayMap component where SMS contents could be leaked via log information disclosure. The root cause is information disclosure in ArrayMap that enables a local information leak with neither user interaction nor remote access require...