1357 matches found
X (Formerly Twitter): Accepting error message on twitter sends you to attacker site
Summary: Accepting error message on twitter sends you back to attacker site. Description: 1. The link https://twitter.com/i/flow shows up an error message with an OK button 2. When you are not logged in, clicking in that OK button takes you back to twitter.com 3. But if you open that link when yo...
The New Year Calls for a Change in the OT Industry’s State of Security
In 2014, a Western European steel mill suffered serious damage from a phishing attack that penetrated its IT and Operational Technology OT networks the software and hardware dedicated to monitoring and controlling physical devices where attackers gained control of plant equipment. In 2018, 74% of...
Athenz Input Validation Error Vulnerability
Athenz is an open source authentication and authorization platform. The platform is mainly used for X.509 certificate-based service authentication and access control based on fine-grained roles in dynamic infrastructures. An input validation error vulnerability exists in Athenz v1.8.24 and earlie...
Open redirect vulnerability in login.jsp - CVE-2019-20901
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the osdestination parameter...
JVN#57070811: Athenz vulnerable to open redirect
Athenz provided by Verizon Media contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the Software Update the software to...
CVE-2014-2213
Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scrsendmd5.php...
Design/Logic Flaw
The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...
CVE-2018-13257
The CVE-2018-13257 vulnerability affects Blackboard Learn (2018-07-02) in the bb-auth-provider-cas authentication module. The issue is HTTP host header spoofing during CAS service ticket validation, enabling a phishing attack from the CAS server login page. Connected records consistently describe...
Stripo Inc: Redirection through referer tag
Summary: I replaced the referer value https://stripo.email/de/ with www.google.com and it worked, it redirected me to google.com Steps To Reproduce: 1. Open URL https://stripo.email/de/subscribe/ 2. Intercept with BurpSuite 3. Change the parameter value of referer and insert any domain you want i...
JVN#65280626: Movable Type vulnerable to open redirect
Movable Type provided by Six Apart Ltd. contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the Software Update the...
Microsoft Office Security Feature Bypass Vulnerability
A security feature bypass vulnerability exists when Microsoft Office does not validate URLs. An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials. An attacker who successfully exploited this vulnerability could perform a phishing attack...
Security Updates for Microsoft SharePoint Server (November 2019)
The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists when Microsoft Office does not validate URLs. An attacker could send a victim a specially crafted...
Mail.ru: [pandao.ru] possibility to attach arbitrary phone number to account registered via social network
It was possible to attach an arbitrary unregistered phone number to account registered via different id e.g. social network id. This behavior can prevent user from registering with his phone number and facilitate phishing attack if victim attempts to login by phone number...
Amazon Linux 2 : httpd (ALAS-2019-1341)
A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.CVE-2019-10092 A vulnerability was...
JVN#45633549: Library Information Management System LIMEDIO vulnerable to open redirect
Library Information Management System LIMEDIO provided by RICOH COMPANY, LTD. contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solutio...
Rudy Giuliani Butt-Dialed a Reporter (Twice!)
A UN phishing attack, Adobe accounts exposed, and more of the week's top security news...
JVN#34634458: PowerCMS vulnerable to open redirect
PowerCMS provided by Alfasado Inc. contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack. Solution Update the Software Update the software t...
X (Formerly Twitter): Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMs
Summary When composing a tweet or a direct message it is possible to use a new line character %0d to seperate two URLs within the actual hyperlinking process, but not the URL displaying process. The new line character acts as an invisible character that disrupts the actual hyperlinking process,...
Greenbone Security Assistant (GSA) < 7.0.3 Host Header Injection Vulnerability - Active Check
Greenbone Security Assistant GSA is prone to an HTTP host header injection vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...