CVE-2019-6120

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

Code injection

A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address...

Design/Logic Flaw

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

Authorization

An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance at the time of December 2017 breach , Projected payout, Mining stats like profitability...

CVE-2019-6122

CVE-2019-6122 is a vulnerability in NiceHash Miner prior to 2.0.3.0 causing user enumeration through separate error messages: submitting a non-existent email triggers “EMAIL DOES NOT EXIST,” while valid emails with incorrect credentials yield a different error. This behavioral difference enables ...

CVE-2019-6121

An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance at the time of December 2017 breach , Projected payout, Mining stats like profitability...

CVE-2019-6121

CVE-2019-6121 affects NiceHash Miner prior to 2.0.3.0. The issue is missing authorization, enabling an adversary to access a miner’s information (e.g., recent payments, unclaimed balance, old balance, projected payout, mining stats) with only a valid email address required to retrieve the informa...

CVE-2019-6120

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 Username Enumeration an adversary...

CVE-2019-6120

NiceHash Miner before version 2.0.3.0 is affected by CVE-2019-6120 due to a missing rate limit when adding a wallet via an email address. This enables an attacker to submit many email addresses to identify valid ones, and can be combined with CVE-2019-6122 (Username Enumeration) to enumerate vali...

First Cyber Attack 'Mass Exploiting' BlueKeep RDP Flaw Spotted in the Wild

Cybersecurity researchers have spotted a new cyberattack that is believed to be the very first but an amateur attempt to weaponize the infamous BlueKeep RDP vulnerability in the wild to mass compromise vulnerable systems for cryptocurrency mining. In May this year, Microsoft released a patch for ...

Chinese Hackers Compromise Telecom Servers to Spy on SMS Messages

A group of Chinese hackers carrying out political espionage for Beijing has been found targeting telecommunications companies with a new piece of malware designed to spy on text messages sent or received by highly targeted individuals. Dubbed "MessageTap ," the backdoor malware is a 64-bit ELF da...

Malicious Package

Overview All versions of comander contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. Recommendation Remove the package...

CVE-2016-10979

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS...

CVE-2016-10979

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS...

CVE-2016-10978

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...

CVE-2016-10978

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...

Cross site scripting

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS...

Cross site request forgery (csrf)

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...

CVE-2016-10979

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS...

CVE-2016-10979

The CVE-2016-10979 entry concerns the fossura-tag-miner WordPress plugin prior to version 1.1.5, which is vulnerable to Cross-Site Scripting (XSS). Root cause is an XSS flaw in the plugin that could affect site users; the vulnerability is documented across multiple sources (NVD, Red Hat and CVE l...