CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

Big name TikTok accounts hijacked after opening DM

High profile TikTok accounts, including CNN, Sony, and—er­—Paris Hilton have been targeted in a recent attack. CNN was the first account takeover that made the news, with Semafor reporting that the account was down for several days after the incident. According to Forbes, the attack happens witho...

WordPress plugin Captcha Code 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...

New V3B Phishing Kit Steals Logins and OTPs from EU Banking Users

New phishing kit targets European bank users! Protect yourself from V3B attacks designed to steal your logins and…...

Beware of scammers impersonating Malwarebytes

Scammers love to bank on the good name of legitimate companies to gain the trust of their intended targets. Recently, it came to our attention that a cybercriminal is using fake websites for security products to spread malware. One of those websites was impersonating the Malwarebytes brand. Image...

PT-2024-26242 · Flyfish · Flyfish

Name of the Vulnerable Software and Affected Versions: FlyFish version 3.0.0 Description: The issue is a buffer overflow via the password parameter on the login page, allowing attackers to cause a Denial of Service DoS via a crafted input. This can potentially lead to system compromise...

Observation of Response Discrepancy to Enumerate Users

Overview Umbraco.Cms.Infrastructure is an infrastructure assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Observation of Response Discrepancy to Enumerate Users due to the handling of the native login screen. An attacker with access to the native login scree...

CVE-2024-28868

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external...

CVE-2024-28868 Umbraco possible user enumeration vulnerability

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external...

Argo CD Security Vulnerability

Argo CD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g. configuration in the Git repository, automatically synchronizing and deploying...

Dropbox Abused in New Phishing, Malspam Scam to Steal SaaS Logins

By Waqas That new Dropbox email landing in your inbox might be part of a phishing or malspam attack! This is a post from HackRead.com Read the original post: Dropbox Abused in New Phishing, Malspam Scam to Steal SaaS Logins...

Code injection

The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address...

Red Hat Keycloak Security Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that originates from a vulnerability that could allow an unauthenticated, remote attacker t...

I Stopped Using Passwords. It's Great—and a Total Mess

Passkeys are here to replace passwords. When they work, it’s a seamless vision of the future. But don’t ditch your old logins just yet...

PT-2023-7614 · Fxc · Fxc Ae1021 +1

Name of the Vulnerable Software and Affected Versions: FXC AE1021 firmware version 2.0.9 and earlier FXC AE1021PE firmware version 2.0.9 and earlier Description: An OS command injection vulnerability exists, allowing an attacker who can log in to the product to execute arbitrary OS commands. The...

GHSA-V5GJ-FX3G-HCPW SQL injection in Apache Submarine

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before...

CVE-2023-37924

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before...

UPM - Microsoft Edge browser does not retain saved credentials in subsequent logins

With Citrix User Profile Management UPM configuration Microsoft Edge browser does not retain saved credentials in subsequent login to VDI...

Apache Submarine SQL Injection Vulnerability

Apache Submarine is a cloud-native machine learning platform from the Apache USA Foundation. A security vulnerability exists in Apache Submarine versions 0.7.0 through 0.8.0 that stems from the presence of a SQL injection vulnerability that could lead to unauthorized logins...

ROS-20231109-02

Vulnerability in GLPI's request and incident handling system is related to information disclosure. Exploitation exploitation of the vulnerability could allow a remote attacker to obtain user logins. GLPI request and incident handling system vulnerability related to the lack of path filtering by...