How Client-Side Protection & Compliance Detects Real-World Magecart Attacks

In this blog, we will take a look at and break down a recent Magecart attack detected and mitigated by Client-Side Protection & Compliance. The impacted customer operates a large international e-commerce business in which one of its websites was compromised with a malicious script...

Mozilla Firefox 跨站脚本漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox error page handling, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used t...

PT-2021-11959

Name of the Vulnerable Software and Affected Versions: RailsAdmin versions prior to 1.4.3 RailsAdmin versions 2.x prior to 2.0.2 Description: The issue allows for XSS via nested forms, which can lead to malicious script execution. Recommendations: For versions prior to 1.4.3, update to version...

PT-2021-15616

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for cross-site scripting XSS via the use of the conversion API for a distributedFile. This can potentially lead to malicious script execution on the client-side...

PT-2020-17394

Name of the Vulnerable Software and Affected Versions Daybyday version 2.1.0 Description The issue allows stored XSS via the Name parameter to the New User screen. This can lead to malicious script execution when the stored data is viewed. Recommendations For Daybyday version 2.1.0, avoid using t...

Mitel MiCollab Insufficient Access Control Vulnerability

Mitel MiCollab is an enterprise collaboration software and tools platform solution. An insufficient access control vulnerability exists in the online help portal in Mitel MiCollab versions prior to 9.2. An attacker could exploit the vulnerability by executing a malicious script to redirect users ...

CVE-2020-27340

The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control...

CVE-2020-27340: Undefined Security Weakness

The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to insufficient access control...

CVE-2020-25010

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an...

CVE-2020-25010

CVE-2020-25010 affects Kyland KPS2204 6-Port Managed DIN-Rail Programmable Serial Device Servers, Software Version R0002.P05. It enables arbitrary code execution by remote attackers who send a crafted POST request and embed a payload in request parameters to instruct the server to write a file. T...

Seotoaster 3.2.0 Cross Site Scripting

Exploit Title: Seotoaster 3.2.0 - Stored XSS on Edit page properties Exploit Author: Hardik Solanki Vendor Homepage: https://www.seotoaster.com/ Software Link: https://crm-marketing-automation-platforms.seotoaster.com/ Version: 3.2.0 Tested on Windows 10 XSS ATTACK: Cross-site Scripting XSS is a...

PT-2020-15886

Name of the Vulnerable Software and Affected Versions Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version: R0002.P05 Description The issue allows remote attackers to execute arbitrary code by uploading a malicious script file. This is achieved by constructin...

CVE-2020-25010: Unrestricted Upload of File with Dangerous Type

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an...

Kyland KPS2204 Code Issue Vulnerability

The Kyland KPS2204 is a programmable protocol converter developed for serial device networking applications by Kyland in Beijing, China. A security vulnerability exists in the Kyland KPS2204 6 Port Managed Din-Rail Programmable Device Servers Software Version:R0002.P05, which can be exploited by ...

CVE-2020-26830

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. Thes...

Authorization

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. Thes...

CVE-2020-26830

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. Thes...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Go. Vulnerability Details CVEID: CVE-2020-24553 DESCRIPTION: Golang Go is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the CGI/FCGI handlers. A remote attacker...

CVE-2020-26837: Improper Limitation of a Pathname to a Restricted Directory

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing path traversal vulnerability to compromise confidentiality exposing elements of the file system, partially compromise integrity allowing the...

PT-2020-16514

Name of the Vulnerable Software and Affected Versions SAP Solution Manager 7.2 User Experience Monitoring version 7.2 Description The issue arises from inadequate access control, allowing a network attacker authenticated as a regular user to perform operations restricted to administrators. This...