Apple Patches Remote 'Invoice Vulnerability' in iTunes, App Store

Apple recently patched a serious issue in its App Store and iTunes Store web app that could have let a remote attacker inject malicious script into invoices that come from Apple and subsequently lead to session hijacking, phishing, and redirect. The vulnerability was unearthed in June by Benjamin...

Threat Outbreak Alert RuleID16955: Email Messages Distributing Malicious Software on October 12, 2015

Medium Alert ID: 40155 First Published: 2015 July 27 22:33 GMT Last Updated: 2015 October 12 18:14 GMT Version: 5 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16955 and...

Critical Persistent Injection Vulnerability in Apple App Store and iTunes

A critical vulnerability has been discovered in the official Apple’s App Store and iTunes Store, affecting millions of Apple users. Vulnerability-Lab Founder and security researcher Benjamin Kunz Mejri discovered an Application-Side input validation web vulnerability that actually resides in the...

Apple iTunes & AppStore - Persistent Invoice Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Invoice Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1512 Apple Security ID: 623920272 Video: http://www.vulnerability-lab.com/getcontent.php?id=1517 Vulnerability...

Apple iTunes & AppStore - Persistent Invoice Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Invoice Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1512 Apple Security ID: 623920272 Video: http://www.vulnerability-lab.com/getcontent.php?id=1517 Vulnerability...

Apple iTunes & AppStore - Persistent Store Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Store Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1517 Video View: https://www.youtube.com/watch?v=iPvmrFgvpDQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1512 Releas...

Apple iTunes & AppStore - Persistent Store Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Store Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1517 Video View: https://www.youtube.com/watch?v=iPvmrFgvpDQ Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1512 Releas...

Threat Outbreak Alert RuleID16286: Email Messages Distributing Malicious Software on July 2, 2015

Medium Alert ID: 39572 First Published: 2015 June 30 13:19 GMT Last Updated: 2015 July 6 13:00 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16286 may...

Threat Outbreak Alert RuleID15980: Email Messages Distributing Malicious Software on October 7, 2015

Medium Alert ID: 39551 First Published: 2015 June 30 13:19 GMT Last Updated: 2015 October 7 19:54 GMT Version: 14 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15980 and...

Threat Outbreak Alert RuleID15996: Email Messages Distributing Malicious Software on June 16, 2015

Medium Alert ID: 39372 First Published: 2015 June 16 14:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15996 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID15992: Email Messages Distributing Malicious Software on June 15, 2015

Medium Alert ID: 39369 First Published: 2015 June 16 14:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15992 may contain the following files: Name | Siz...

CVE-2015-4381

Cross-site scripting XSS vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice"...

Cross site scripting

Cross-site scripting XSS vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice"...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4382

CVE-2015-4382 refers to CSRF vulnerabilities in the Drupal Invoice contributed module. Impacted versions are 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3, allowing remote attackers to hijack the authentication of arbitrary users to perform invoices-related actions (create, delete, or alt...

CVE-2015-4382

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4381

Cross-site scripting XSS vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice"...

CVE-2015-4381

The CVE-2015-4381 entry affects the Drupal Invoice contributed module (versions 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3). The issue is a Cross-Site Scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the "Administer own invoices" permission to inje...

CVE-2015-4382: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4381: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice"...