Breaking down a notably sophisticated tech support scam M.O.

Note: Our Tech support scams FAQ page has the latest info on this type of threat, including scammer tactics, fake error messages, and the latest scammer hotlines. You can also read our latest blog, New tech support scam launches communication or phone call app. The cornerstone of tech support sca...

132 Google Play Apps Booted For Having Malicious IFrames

Google removed 132 apps infected with malicious iFrames from its Google Play store after security researchers discovered a development platform used to create the apps was infected with malware and in turn compromised the apps. Palo Alto Networks’ Unit 42 researchers said the apps were infected...

Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

CVE-2017-5367

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

UBUNTU-CVE-2017-5389

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user...

Acontent CMS Cross-Site Scripting Vulnerability

AContent is an eLearning content creation tool and library that supports importing, exporting, and producing IMS content packages. A cross-site scripting vulnerability exists in the newversion parameter of the install.php page in version 1.3 of Acontent, which can be exploited by an attacker to...

Horos Cross-Site Scripting Vulnerability

Horos is an open source free DICOM medical image viewer. A cross-site scripting vulnerability exists in Horos version 2.1.0, which can be exploited by attackers to steal cookie-based authentication or inject malicious scripts...

BackdoorMan - Toolkit That Helps You Find Malicious, Hidden And Suspicious PHP Scripts And Shells

A Python open source toolkit that helps you find malicious, hidden and suspicious PHP scripts and shells in a chosen destination, it automates the process of detecting the above. Purpose The main purpose of BackdoorMan is to help web-masters and developers to discover malicious scripts in their...

WordPress Image Gallery Plugin HTML Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of the blog platform , the platform supports PHP and MySQL server set up a personal blog site . Image Gallery is one of the image processing plug-ins . WordPress Image Gallery version 1.9.65 there is an HTML...

U.S. Dept Of Defense: Reflected cross-site scripting vulnerability on a DoD website

A cross-site scripting XSS vulnerability was found on a Department of Defense. XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @konduru-jashwanth able to demonstrate this...

Arbitrary File Upload Vulnerability in ucms

UCMS is an open source content management system that can be used to develop a variety of various enterprise stations, article stations and station systems. ucms background file management system file upload vulnerability. As the program does not judge the upload file, allowing attackers to explo...

contribute.theguardian.com XSS vulnerability

Vulnerable URL: https://contribute.theguardian.com/eu?INTCMP="%3E%3Csvg onload=alert'OPENBUGBOUNTY'%3E// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

Oracle Netbeans IDE 8.1 Directory Traversal Vulnerability

Exploit for php platform in category local exploits + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-NETBEANS-IDE-DIRECTORY-TRAVERSAL.txt + ISR: ApparitionSec Vendor: =============== www.oracle.com Product:...

Oneblog 2.0 Cross Site Scripting

Exploit Title :----------------- : Oneblog v2.0 - postsnew.php - Stored XSS Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork :---------------- : - Date...

File Upload Vulnerability in X6CMS System

X6CMS, fully known as Xiaoliu Website Content Management System, is a fully functional marketing website management platform. X6CMS system has a file upload vulnerability, which can directly upload malicious script files to control the server...

BSNL Teracom Router Firmware Rewrite / Link Modification

Multiple Vulnerabilities in TERACOM ROUTER Author: Ajay Gowtham aka AJOXR Contact: gowtham.ajay5 at gmail.com Vulnerability Type: Insecure Upload File Permissions Affected Module: Upload Functionality Criticality: Medium Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+...

OpenAM Cross-Site Scripting Vulnerability

ForgeRock is an enterprise identity management platform. A cross-site scripting vulnerability exists in ForgeRock OpenAM, which allows attackers to exploit the vulnerability to execute malicious scripts...

BlackBerry Enterprise Service Cross-Site Scripting Vulnerability (CNVD-2016-02335)

BlackBerry Enterprise Server is a wireless solution. The solution provides a unified architecture for mobile devices to access enterprise applications, wireless email communications. A cross-site scripting vulnerability exists in BlackBerry Enterprise Server, which allows remote attackers to...

Anti-Malware Security & Brute-Force Firewall <= 4.15.42 - XSS & CSRF

The Anti-Malware Security and Brute-Force Firewall WordPress plugin was affected by a XSS & CSRF security vulnerability. XSS vulnerability in https://wordpress.org/plugins/gotmls/ has been identified. While I scan a site with that plugin , i had a file '".png and it was skippped , but result was...

CVE-2016-2165 Loggregator Request URL Paths | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation, VMware Cloud Foundry Versions Affected cf-release v231 and lower Description The Loggregator Traffic Controller endpoints are not cleansing request URL paths when they are invalid and is returning them in the 404 response. This could allow maliciou...