CVE-2022-41797

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a...

CVE-2022-41797

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior to 3.3.5 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a...

PT-2022-26076 · Unknown · Lemon8 App For Android +1

Name of the Vulnerable Software and Affected Versions: Lemon8 App for Android versions prior to 3.3.5 Lemon8 App for iOS versions prior to 3.3.5 Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing a remote attacker to lead a user to access ...

CVE-2022-26954

Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the 1 ChangePassword function, 2 SignInCustomerAsync function, 3...

Security Bulletin: WebSphere eXtreme Scale Monitoring Console Web Vulnerabilities (CVE-2013-5390, CVE-2013-5393, CVE-2013-5394)

Abstract Three web security vulnerabilities were identified in the WebSphere eXtreme Scale monitoring console, those being a cross site scripting vulnerability, a log-off processing weakness, and vulnerability to a phishing attack. Content VULNERABILITY DETAILS: CVEID:CVE-2013-5390 DESCRIPTION: A...

Input validation

User input included in error response, which could be used in a phishing attack...

CVE-2021-27774 An injection vulnerability affects HCL Digital Experience

User input included in error response, which could be used in a phishing attack...

CVE-2021-27774

CVE-2021-27774 involves HCL Digital Experience and an injection-type vulnerability where user input is echoed in an error response. This behavior could enable phishing attacks by exposing or misusing input data via error messages. The connected documents corroborate that the issue centers on inpu...

CVE-2021-27774 An injection vulnerability affects HCL Digital Experience

User input included in error response, which could be used in a phishing attack...

The vulnerability of the implementation of the DefaultActionMapper mechanism in the Apache Struts software platform allows attackers to carry out phishing attacks.

The vulnerability of the DefaultActionMapper mechanism implemented by the Apache Struts software platform is related to insufficient validation of input data during the processing of parameters like redirect and redirectAction:prefix. Exploiting this vulnerability allows a malicious actor to carr...

[update] American Airlines suffers data breach after phishing incident

Major airline American Airlines has fallen victim to a data breach after a threat actor got access to the email accounts of several employees via a phishing attack. According to a published notice of a security incident, the data breach was discovered in July 2022. How it happened American Airlin...

A week in security (September 12 – 18)

Last week on Malwarebytes Labs: The North Face hit by credential stuffing attack Facebook engineers aren't sure where all user data is kept 6 patch management best practices for businesses The MSP playbook on deciphering tech promises and shaping security culture Apple puts the password on life...

Massive Data Breach at Uber

Its big: The breach appeared to have compromised many of Ubers internal systems, and a person claiming responsibility for the hack sent images of email, cloud storage and code repositories to cybersecurity researchers and The New York Times. "They pretty much have full access to Uber," said Sam...

Iranian Hackers Target High-Value Targets in Nuclear Security and Genomic Research

Hackers tied to the Iranian government have been targeting individuals specializing in Middle Eastern affairs, nuclear security, and genome research as part of a new social engineering campaign designed to hunt for sensitive information. Enterprise security firm Proofpoint attributed the targeted...

CVE-2022-20863 Cisco Webex Meetings App Character Interface Manipulation Vulnerability

A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character...

Final Fantasy 14 players targeted by QR code phishing

Final Fantasy 14, the smash-hit online role playing game, is under fire from scammers. The attack is a devious way to try and compromise player accounts, making use of free item promises and bogus QR codes. As the game is a constantly changing service, its almost impossible to keep up with new...

Why the Twilio Breach Cuts So Deep

The phishing attack on the SMS giant exposes the dangers of B2B companies to the entire tech ecosystem...

PYSEC-2022-250

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-251

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-252

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...