8379 matches found
Dark Web Drug Seller Sinmed Goes Down—Thanks to ATM Withdrawals
Investigators from the New York district attorney's office stumbled across dark web drug vendor "sinmed" thanks to suspicious ATM transactions...
Cross site request forgery (csrf)
FastAdmin V1.0.0.20190111beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI...
CVE-2019-11078
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI...
New Relic: Stored XSS at APM apps labels autocomplete dropdown (apps listing)
Hey team, I have discovered the stored XSS vulnerability triggered at APM apps labels autocomplete dropdown. Only admins are able to add labels to apps, so it seemed to me that this XSS impact is "admin to owner" only. But I googled a little and stumbled upon the NEWRELICLABELS environment variab...
TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping
Overview FireEye can now confirm that we have uncovered and are responding to an additional intrusion by the attacker behind TRITON at a different critical infrastructure facility. In December 2017, FireEye publicly released our first analysis on the TRITON attack where malicious actors used the...
Say hello to Baldr, a new stealer on the market
By William Tsing, Vasilios Hioureas, and Jérôme Segura Over the past few months, we have noticed increased activity and development of new stealers. Unlike many banking Trojans that wait for the victim to log into their bank's website, stealers typically operate in grab-and-go mode. This means th...
Description of the security update for SharePoint Server 2019: April 9, 2019
None None...
People Spent More Time with Their Mom this Mother's Day in the U.K.
The first major peak traffic event for online shopping in the United Kingdom is Mother's Day, held this year on Sunday, March 31. As we did during peak holiday traffic events last year, we tabulated and analyzed aggregate statistics from global online retail traffic that touched nearly 100 retail...
CVE-2019-10676
An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within t...
CVE-2019-10676
An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window will appear prompting the user if they want to save this new password. This pop-up window will persist on any page the user enters within t...
New Relic: Stored XSS at APM applications listing
Hello team, I have discovered that the attacker which can create APM app or modify the existing app name can cause a stored XSS firing at APM apps listing page. There is a script like the following at the APM apps listing page: javascript window.applicationData =...
Supported Databases for Virtual Apps and Desktops AND Citrix Provisioning (PVS)
Citrix is committed to ensuring that our products function with the latest Microsoft SQLdatabases.Citrix supplies reasonable efforts to ensure compatibility with upcoming database releases. New versions of supported databases released after our products have been released, must work. However,...
Hacking Instagram to Get Free Meals in Exchange for Positive Reviews
This is a fascinating hack: In today's digital age, a large Instagram audience is considered a valuable currency. I had also heard through the grapevine that I could monetize a large following -- or in my desired case -- use it to have my meals paid for. So I did just that. I created an Instagram...
New Relic: Giving myself access to NR1 UI / one.newrelic.com without the proper feature flags on my account
@jonbottarini discovered a way to access the NR1 UI prior to it being generally available. This allowed him to test against and evaluate NR1 while it was still in a prerelease state. He describes the techniques used in this blog post. I used Burp Suite's match/replace rules to find this issue,...
New Relic: Full name of other accounts exposed through NR API Explorer (another workaround of #476958)
It's the gift that keeps on giving, and I've found another gift! Another way to find the full name of another New Relic user, without having them confirm their account and join your team. Thsi time I make use of the New Relic API which pulls details for me through the /v2/users.json endpoint. Ste...
DLA-1744-1 tzdata - new upstream version
Bulletin has no description...
OPENSUSE-SU-2019:1084-1 Security update for ucode-intel
This update for ucode-intel fixes the following issues: Updated to the 20190312 bundle release bsc1129231 New Platforms: - AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile - WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile - CFL-S P0 6-9e-c/22 000000a2 Cor...
Security update for ucode-intel (moderate)
openSUSE Security Update: Security update for ucode-intel Announcement ID: openSUSE-SU-2019:1084-1 Rating: moderate References: 1129231 Affected Products: openSUSE Leap 15.0 An update that contains security fixes can now be installed. Description: This update for ucode-intel fixes the following...