CVE-2019-5413

CVE-2019-5413 affects the Node.js middleware package morgan (

CVE-2019-5413

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan 1.9.1...

Code Injection

Overview Verisons of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. Recommendation Update to version 1.9.1 or later. References - HackerOne Report - Node.js security-wg - GitHub Advisory...

Prototype Pollution

morgan is vulnerable to prototype pollution. A lack of object validation allows an attacker to inject arbitrary commands...

Node.js third-party modules: Code Injection Vulnerability in morgan Package

I would like to report a code injection vulnerability in morgan. It allows an attacker to inject arbitrary JS commands in certain situations. Module module name: morgan version: 1.9.0 npm page: https://www.npmjs.com/package/morgan Module Description HTTP request logger middleware for node.js Name...

morgan-funeralhome.com XSS vulnerability

Open Bug Bounty ID: OBB-658384 Description| Value ---|--- Affected Website:| morgan-funeralhome.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

morgan-multimedia.fr XSS vulnerability

Open Bug Bounty ID: OBB-567962 Description| Value ---|--- Affected Website:| morgan-multimedia.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

morgan-motor.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-548237 Description| Value ---|--- Affected Website:| morgan-motor.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

morgan-motor.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-544233 Description| Value ---|--- Affected Website:| morgan-motor.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

J.P. Morgan ACCESS Mobile - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application J.P. Morgan ACCESS Mobile published at the 'play' market has multiple vulnerabilities...

J.P. Morgan Mobile - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application J.P. Morgan Mobile published at the 'play' market has multiple vulnerabilities...

webmail.morgan-county.net XSS vulnerability

Vulnerable URL: http://webmail.morgan-county.net/webmail/?color=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 11:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

Morgan Stanley Research - Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Morgan Stanley Research published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID15073: Email Messages Distributing Malicious Software on May 4, 2015

Medium Alert ID: 38665 First Published: 2015 May 4 18:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15073 may contain the following files: Name | Size ...

Ubuntu 14.04 LTS : mime-support vulnerability (USN-2453-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2453-1 advisory. Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked...

USN-2453-1: mime-support vulnerability

Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked into opening a file with a specially-crafted filename, a remote attacker could possibly execute arbitrary code...

Morgan Stanley Insider Theft Wealth Management Client Data

The financial services giant Morgan Stanley announced yesterday that that an employee had stolen sensitive information pertaining to more than 900 of the firm’s wealth-management clients. According to a company press release, the wealth management employee in question “has been terminated.”...

A New Cold War – with Many Sides

A New Cold War - with Many Sides Theres a lot we still dont know about the FBIs investigation of the data theft at JP Morgan Chase & Co. Criminal hackers based in Russia were targeting U.S. financial institutions long before Russia annexed Crimea or the West responded with sanctions. Is this trul...

Tracy Morgan Dead? Facebook Scam Targeting Users with Malware

Oh MY God! Is Tracy Morgan Really Dead? NO, Thankfully it’s only a hoax, but scammers announced the popular comedian and actor Tracy Morgan dead. Another Facebook scam is circulating across the social networking website just a day before the former “Saturday Night Live” and “30 Rock” star Tracy...

Half Million Users Affected in JP Morgan Ucard data breach

An attack on the computer networks of banking giant JP Morgan Chase & Co. may have exposed sensitive information belonging to 465,000 prepaid cash-card holders, according to a Reuters report. JP Morgan said the attack targeted Web servers handling its Ucard program in mid-September and that the...