CVE-2022-25778

Cross-Site Request Forgery CSRF vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session...

Chinese "Override Panda" Hackers Resurface With New Espionage Attacks

A Chinese state-sponsored espionage group known as Override Panda has resurfaced in recent weeks with a new phishing attack with the goal of stealing sensitive information. "The Chinese APT used a spear-phishing email to deliver a beacon of a Red Team framework known as 'Viper,'" Cluster25 said i...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.158,...

CVE-2022-28870

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails...

CVE-2022-28870

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails...

Design/Logic Flaw

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the browser did not show full URL, such as port number...

CVE-2022-28869

CVE-2022-28869 affects F-Secure SAFE browser (Android in CVE records) where the browser does not display the full URL, such as the port number, enabling address-bar spoofing. This could allow phishing attacks via malicious sites exploiting the UI omission. The vulnerability description consistent...

CVE-2022-28869 Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the browser did not show full URL, such as port number...

CVE-2022-28870 Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails...

The vulnerability of Siemens SINEMA Remote Connect lies in the redirection of the URL to an unreliable website, allowing attackers to carry out phishing attacks.

The vulnerability of Siemens SINEMA Remote Connect relates to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks using a specially created link...

Watch out for fake WhatsApp “New Incoming Voicemessage” emails

Thanks to the Threat Intelligence team for their help with this article. Security researchers from Armorblox, a cybersecurity company specializing in email-based threats, have encountered a fake WhatsApp email with the subject "New Incoming Voicemessage." The spoofed WhatsApp voicemail notificati...

Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware

At least three different advanced persistent threat APT groups from across the world have launched spear-phishing campaigns in mid-March 2022 using the ongoing Russo-Ukrainian war as a lure to distribute malware and steal sensitive information. The campaigns, undertaken by El Machete, Lyceum, and...

CVE-2022-26950

Archer 6.x through 6.9 P2 6.9.0.2 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to t...

RSA Archer 输入验证错误漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all of our enterprise assets, as well as some of the monitored information, and organize it into a unified platform,...

Microsoft Help Files Disguise Vidar Malware

Where’s the last place you’d expect to find malware? In an email from your mother? Embedded in software you trust and use everyday actually, that’s probably the first place you should look? How about in a technical documentation file? In a report published Thursday, Trustwave SpiderLabs revealed ...

Nivistealer - Steal Victim Images Exact Location Device Info And Much More

Steal Victim Images Exact Location Device Info And Much More Features of Nivi-Stealer: Steal Ip Steal Device Info Uses Device Gps to steal exact location Steal pic from front camera Send logs to discord also save them locally in a txt file Works on android,windows,linux,mac os Uses iframe to load...

Microweber cross-site scripting vulnerability (CNVD-2022-20098)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber before 1.3, which stems from t...

Static Code Injection

Description The Microweber application allows HTML tags in the "First name", "Last name" and "Phone number" which can be exploited by Injecting HTML payloads. Proof of Concept 1.While buying product we need to fill contact information form. 2.Insert your html code in code block. e.g., Hurry Up!Go...

Improper Resolution of Path Equivalence

DESCRIPTION Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. This behavior can be...

GSD-2022-1000283 Multiple vulnerabilities in NFT version All

A phishing attack was conducted against users of the Opensea.io NFT platform, resulting in 17 users losing approx. $1.7 Million USD in NFTs. This incident appears to include email phishing, a fake website, bad wallet UI that make it difficult for users to know exactly what is going on and use of...