The vulnerability of the McAfee Total Protection anti-virus protection lies in its lack of access control mechanisms, which allows attackers to enhance their privileges.

The vulnerability of the McAfee Total Protection antivirus protection lies in its lack of access control mechanisms. Exploiting this vulnerability allows attackers to enhance their privileges by manipulating symbolic links or executing malicious scripts or programs...

All in One SEO Pack < 3.6.2 - Authenticated Stored Cross-Site Scripting

This flaw allowed authenticated users with contributor level access or above the ability to inject malicious scripts that would be executed if a victim accessed the wp-admin panel’s ‘all posts’ page. PoC "Exploit Post", "content" = "\n Test2 \n", "status"="pending"; $postdata = jsonencode$data;...

U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

CVE-2019-12773

An issue was discovered in Verint Impact 360 15.1. At wfo/help/helppopup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFrame. Attackers may use this in conjunction with social engineering to embed malicious scripts or phishing pages on a site where this produc...

CVE-2020-6278

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

CVE-2020-6278

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

Keeper Threat Group Rakes in $7M from Hundreds of Compromised E-Commerce Sites

Since its launch three years ago, the Keeper threat group has compromised more than 570 e-commerce websites, from online liquor stores to Apple product resellers. And experts warn of future, increasingly sophisticated attacks against online merchants worldwide. The Keeper group, a faction of the...

CVE-2020-13642

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The actionbuildercontent function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panelsdata $POST variable allows for malicious JavaScript to be...

Cross-Site Scripting (XSS)

dropkickjs is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input elements, allowing a malicious user to inject and execute malicious web scripts...

McAfee Active Response (MAR) for Mac Elevation of Privilege Vulnerability

McAfee Active Response MAR is an endpoint detection and response tool for security threats from the U.S.-based McAfee. The product supports features such as rapid access to threat data, threat alerts and centralized management. A security vulnerability exists in McAfee MAR prior to version 2.4.3...

Cross-site Scripting (XSS)

github.com/ctripcorp/apollo is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the variable valueWithHiddenChars in showHiddenChars function in item-modal-directive.js, allowing a malicious user to inject and execute malicious web scripts...

Malicious Package

Overview acts-ascrafter is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using acts-ascraft...

Malicious Package

Overview active-merchantmollie is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview acts-asfuzzysearch is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview asset-symlink is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using asset-symlink...

Malicious Package

Overview cordovarake is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using cordovarake...

Malicious Package

Overview gamer-stats is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using gamer-stats...

Malicious Package

Overview battering-ram is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using battering-ram...

Malicious Package

Overview appcli is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using appcli altogether...

Malicious Package

Overview batch-insert is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using batch-insert...