Spanish Police Takes Down Massive Cybercrime Ring, 40 Arrested

The National Police of Spain said it arrested 40 individuals for their alleged involvement in an organized crime gang called Trinitarians. Among those apprehended include two hackers who carried out bank scams through phishing and smishing techniques and 15 other members of the crime syndicate, w...

cdi.org.pt Cross Site Scripting vulnerability OBB-3319154

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

oyh.org.au Cross Site Scripting vulnerability OBB-3312735

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign. This involves using a ZIP archive lure pertaining to India's Defence Research and Development Organizatio...

caan.org.uk Cross Site Scripting vulnerability OBB-3297431

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

Top 10 challenges of building an in-house application security program

Building a successful application security program can be a daunting task, as it involves many different skill sets. Resource constraints, lack of expertise, and cultural resistance are among the many challenges preventing organizations from reaping the full benefits of an in-house AppSec program...

fasocivic.org Cross Site Scripting vulnerability OBB-3291409

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ptca.org Cross Site Scripting vulnerability OBB-3285613

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Daggerfly APT Deploys MgBot to Target African Telecoms Organization

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Daggerfly advanced persistent threat group has been observed using previously unseen plugins from the MgBot malware framework in a recent campaign. To receive real-time threat advisories, please foll...

How to put your organization’s cloud security strategy into action

CISOs of Paramount, Aon and Wiz reveal their secrets for creating a future-proof approach to cloud security...

CVE-2014-2912

The connected document describes an insecure tempfile usage in Ansible, where temporary file names are derived from the system time, enabling an attacker to guess the filename and potentially disclose sensitive information. No product versions, exact vulnerability scope, or patch details are prov...

CVE-2014-1865

The CVE-2014-1865 entry is supported by a Veracode advisory (VERACODE:4217) describing an information-disclosure vulnerability in fat_free_crm where password-related attributes — password_hash , password_salt , and password_confirmation — are not filtered from logs, exposing sensitive data to mal...

CVE-2014-1866

The connected VERACODE entry documents a vulnerability in fat_free_crm: Information leakage via error pages. The root cause is that consider_all_requests_local is set to true by default in production, causing 404 and 500 error pages to expose server setup information. The document does not provid...

CVE-2014-9086

The connected Veracode entry identifies a vulnerability in ImageMagick characterized as an information disclosure through a file descriptor leak caused by a corrupted file. Affected component: ImageMagick’s handling of file inputs may leak file descriptors, enabling exposure of sensitive data. Ro...

CVE-2014-1862

The connected document identifies a concrete issue in fat_free_crm: unauthorised new user signup due to users_controller not preventing account creation via crafted POST requests. This results in unapproved signups and potential misuse. The description does not provide a remediation. No other aff...

CVE-2017-9672

Technical details for CVE-2017-9672 are not publicly available in the provided documents. Monitor for updates from the issuing organization; no affected products, versions, or exploitation details are specified here.

CVE-2018-9863

The CVE-2018-9863 entry concerns the express-useragent Node.js/ExpressJS middleware. The connected documents reveal a concrete vulnerability: lack of sanitization/escaping of the HTTP User-Agent header , which an attacker can exploit to trigger Cross-site Scripting (XSS) . Impact described across...

CVE-2018-12119

CVE-2018-12119 is a reserved candidate in Initial Description; connected data indicates a Cross-site Scripting (XSS) issue in knowledge_repo due to lack of sanitization of user-supplied parameters (e.g., comments) when rendering templates. The vulnerability is tied to knowledge_repo’s web renderi...

CVE-2017-12968

The connected document provides concrete details for CVE-2017-12968: libexiv2.so is vulnerable to a denial of service (DoS) via a heap-based buffer overflow. The vulnerability exists in basicio.cpp, causing an out-of-bounds write in Exiv2::Image::printIFDStructure. This information confirms the a...