CVE-2019-17521

Landing-CMS 0.0.6 is affected by a CSRF vulnerability that can change the admin password via the password/ URI. The issue is documented across multiple sources (e.g., NVD entry CVE-2019-17521 and Red Hat/CNVD mirrors). The root cause described in the references is insufficient verification of req...

CVE-2019-17521

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,...

Library-Themed University Phishing Attack Expands to Massive Scale

Indicating a campaign of massive scale, at least 20 new phishing domains targeting more than 60 universities in Australia, Canada, Hong Kong, Switzerland, the United Kingdom and the United States have cropped up, bent on lifting credentials from students heading back to school. The domains are...

CVE-2016-10806

cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page SEC-110...

Design/Logic Flaw

cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page SEC-110...

CVE-2016-10806

cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page SEC-110...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20931

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page SEC-405...

CVE-2018-20931

The CVE-2018-20931 issue affects cPanel prior to 70.0.23, where demo (non-privileged) accounts can execute code via the Landing Page (SEC-405). The vulnerability enables code execution through the web interface and is reflected in multiple sources (e.g., NVD, RH, CNVD). Affected product: cPanel W...

WordPress AND-AntiBounce 1.0.3 Open Redirection

Exploit Title : WordPress 5.1.1 WPBounce AND-AntiBounce Plugins 1.0.3 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 27/03/2019 Vendor Homepage : devrix.com - wpbounce.com Software Information Links :...

openSUSE Security Update : glibc (openSUSE-2019-422)

This update for glibc fixes the following issues : This security issue was fixed : - Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs boo1092877, CVE-2018-11237 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Years-Long Phishing Campaign Targets Saudi Gov Agencies

An ongoing three-year-old phishing campaign has been targeting the credentials of Saudi Arabian government agencies — with a financially motivated actor the likely culprit. The campaign, code-named “Bad Tidings,” has siphoned victims’ credentials by pretending to be the Kingdom’s Ministry of...

Widespread Malvertising Campaign Hijacks 300 Million Sessions

A massive malvertising campaign targeting iOS devices hijacked a whopping 300 million browser sessions in just 48 hours. Researchers at Confiant recorded the campaign Nov. 12, and said that the threat actor behind the campaign is still active to this day. A malicious landing page According to...

Teltonika RUT9XX Unauthenticated OS Command Injection Exploit

Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges...

Cross site scripting

The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting XSS. An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies...

CVE-2018-15903

The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting XSS. An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies...

RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique

Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...

openSUSE Security Update : glibc (openSUSE-2018-600)

This update for glibc fixes the following issues : This security issue was fixed : - Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs boo1092877, CVE-2018-11237 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Security update for glibc (moderate)

This update for glibc fixes the following issues: This security issue was fixed: - Fixed an buffer overwrite issue in memcpy for Knights Landing CPUs boo1092877, CVE-2018-11237...