Behind the Scenes of a Tailor-Made Massive Phishing Campaign

A global phishing campaign caught our attention after one of our colleagues was targeted by, and nearly fell victim, to a social engineering attack. The campaign involved more than 800 different scam domains and impersonated around 340 legitimate companies all over the world – including well-know...

SUSE SLES12 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:3122-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3122-1 advisory. python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler bsc1211741 kiwi-desc-saltboot: -...

SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:3131-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3131-1 advisory. Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations bsc1211741 Bug fixe...

SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:3123-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3123-1 advisory. Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain configurations bsc1211741 Bug fixe...

SUSE SLED15: prometheus-blackbox_exporter / python2-tornado / python3-tornado / etc (SUSE-SU-2023:3144-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3144-1 advisory. python-tornado: - Security fixes: CVE-2023-28370: Fixed an open redirect issue in the static file handler...

SUSE SLED15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2023:3145-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3145-1 advisory. Security fixes: - CVE-2023-28370: Fix an open redirect vulnerability in 'StaticFileHandler' under certain...

PT-2023-23079 · Slate · Slate

Name of the Vulnerable Software and Affected Versions: Slate affected versions not specified Description: A missing origin validation in the Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks. Recommendations: At the moment, the...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows hackers to carry out phishing attacks

The vulnerability of Google Chrome’s Picture In Picture technology is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks remotely...

CVE-2022-30280

/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application even if it implements a CSRF token for the random GET request does not ever verify a CSRF token. With a litt...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows hackers to carry out phishing attacks

The vulnerability of Google Chrome’s Picture In Picture technology is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to conduct phishing attacks using a specially created HTML page...

Medium: python-tornado

Issue Overview: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370 Affected Packages: python-tornado Note...

Medium: python3-tornado

Issue Overview: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370 Affected Packages: python3-tornado Not...

Medium: python-tornado

Issue Overview: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370 Affected Packages: python-tornado Issu...

IBM Security Verify Access 输入验证错误漏洞

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

CVE-2023-37947

CVE-2023-37947 affects the Jenkins OpenShift Login Plugin. The vulnerability is an open redirect: plugin versions 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determine that a login-redirect URL legitimately points to Jenkins, enabling phishing by redirecting victims to a malicious site after...

Ubiquiti UniFi Network 跨站脚本漏洞

Ubiquiti UniFi Network is a wireless network management software solution from Ubiquiti, Inc. It is used to set up and manage UniFi Network devices. A security vulnerability exists in Ubiquiti UniFi Network version 7.3.83 and prior versions that originates from a vulnerability that allows a...

PT-2023-25152 · Unknown · Piigab M-Bus

Name of the Vulnerable Software and Affected Versions: PiiGAB M-Bus affected versions not specified Description: PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker could send a phishing email to the device owner with a link that, when clicked, executes a certain command if the...

Mageia: Security Advisory (MGASA-2023-0211)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2023-0211 Updated python-tornado packages fix security vulnerability

Remote unauthenticated attacker may redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370...

How Generative AI Can Dupe SaaS Authentication Protocols — And Effective Ways To Prevent Other Key AI Risks in SaaS

Security and IT teams are routinely forced to adopt software before fully understanding the security risks. And AI tools are no exception. Employees and business leaders alike are flocking to generative AI software and similar programs, often unaware of the major SaaS security vulnerabilities...