CVE-2019-8274

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212...

ATM robber WinPot: a slot machine instead of cutlets

Automation of all kinds is there to help people with their routine work, make it faster and simpler. Although ATM fraud is a very peculiar sort of work, some cybercriminals spend a lot of effort to automate it. In March 2018, we came across a fairly simple but effective piece of malware named...

Be wary of Mega Millions winner “giveaway” on social media

I don't do lotteries, but if I did, I'd probably never, ever win in a million years. That's not a problem faced by 20-year-old Shane Missler, winner of the fourth-largest haul in Mega Millions' 21 years of handing out large bundles of cash. He's on record as saying he wants to "do some good" for...

Threat Outbreak Alert RuleID30633: Email Messages Distributing Malicious Software on September 18, 2017

Medium Alert ID: 55316 First Published: 2017 September 18 14:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30633 may contain the following files: Name ...

IWEBSOUL CMS 1.0 SQL Injection Vulnerability

IWEBSOUL CMS version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Title: ======= IWEBSOUL CMS - Multiple SQL Injection Vulnerabilities & Authentication Bypass Introduction: ============== Intrepid Websoul Private Limited - iWebsoul is a rapidly...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**

@prateek0490 found a IDOR issue which can deactivate any special offer in our platform...

modelingcreator.com XSS vulnerability

Vulnerable URL: http://www.modelingcreator.com/fr/offre-d-emploi.php/%22%27--!%3E%3Cscript%3Ealert'OPENBUGBOUNTY'%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 12.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknow...

openssh security and bug fix update

5.3p1-122 - Allow to use ibmca crypto hardware 1397547 - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes 1405374 5.3p1-121 - Fix missing hmac-md5-96 from server offer 1373836 5.3p1-120 - Prevent infinite loop when Ctrl+Z pressed at password prompt 1218424 - Remove...

Hotel Booking Script 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Hotel & Tour Package Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/hotel-booking-script Demo:...

Threat Outbreak Alert RuleID28316: Email Messages Distributing Malicious Software on March 15, 2017

Medium Alert ID: 53040 First Published: 2017 March 15 17:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28316 may contain the following files: Name | Si...

FreeBSD : asterisk -- Crash on SDP offer or answer from endpoint using Opus (9e6640fe-be3a-11e6-b04f-001999f8d30b)

The Asterisk project reports : If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the...

brmethodprofit.com XSS vulnerability

Vulnerable URL: http://brmethodprofit.com/b/special-offer/?clickID=...

WordPress Google SEO Pressor Snippet Plugin <= 1.2.6 - Reflected XSS

This plugin is prone to a reflected cross site scripting vulnerability, because these parameters are not sanitized: "Address Region", "Longitude", "Latitude", "Event type", "Offer aggregate", "Low Price", "High Price", "Offer Url", "Price", "Events Website", "Offer Quantity", "Price valid Until",...

Threat Outbreak Alert RuleID20841: Email Messages Distributing Malicious Software on February 2, 2016

Medium Alert ID: 43375 First Published: 2016 February 2 14:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20841 may contain the following files: Name |...

Somebody Offered Money to Raspberry Pi Foundation for Pre-Installing Malware

The Raspberry Pi is now gaining attention from malware distributors who want the popular mini-computers to deliver with pre-install malware. The Raspberry Pi Foundation has made a shocking revelation that the charitable foundation has been offered money to install malware onto the Raspberry Pi...

activeyou.co.uk XSS vulnerability

Vulnerable URL: http://www.activeyou.co.uk/offers/marbella/?cid=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 10:28 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

Threat Outbreak Alert RuleID18998: Email Messages Distributing Malicious Software on October 29, 2015

Medium Alert ID: 41752 First Published: 2015 October 27 13:48 GMT Last Updated: 2015 October 29 14:35 GMT Version: 4 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18998...

aromes-et-gourmandises.fr XSS vulnerability

Vulnerable URL: http://www.aromes-et-gourmandises.fr/shop.php?action=%22%22;%3C/script%3E%3Cscript%3Eprompt%28/XSSPOSED/%29%3C/script%3E%3C%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Code injection

Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service file descriptor consumption via an SDP offer containing only incompatible codecs...

CVE-2015-1558

Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service file descriptor consumption via an SDP offer containing only incompatible codecs...