CVE-2019-5969

CVE-2019-5969 is an open redirect vulnerability in WESEEK GROWI (v3.4.6 and earlier) that allows a logged-in user to be redirected to an arbitrary site via the login flow. The clinical detail across connected sources consistently identifies the affected product as GROWI, with the vulnerability oc...

Security Bulletin: A vulnerability in Apache Tomcat affects the IBM FlashSystem V840 and V9000

Summary A vulnerability exists in Apache Tomcat to which the IBM FlashSystem™ V840 and FlashSystem V9000 are susceptible CVE-2018-11784. An exploit of this vulnerability could allow a remote attacker to redirect a user to arbitrary websites. Vulnerability Details CVEID: CVE-2018-11784 DESCRIPTION...

CVE-2019-4153

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user ...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Access Manager Appliance

Summary Multiple Security vulnerabilities have been fixed in the 9.0.7 IBM Security Access Manager ISAM appliance. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious...

Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

GHSA-X9P2-FXQ6-2M5F Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

Hackers Are After Your Personal Data – Here’s How to Stop Them

Our lives are increasingly digital. We shop, socialize, communicate, watch TV and play games — all from the comfort of our desktop, laptop, or mobile device. But to access most of these services we need to hand over some of our personal data. Whether it’s just our name and email address or more...

Johnson Controls exacqVision Enterprise System Manager

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor: Johnson Controls Equipment: exacqVision Enterprise System Manager ESM Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow malicious code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS...

WESEEK GROWI Input Validation Error Vulnerability

WESEEK GROWI is a suite of team collaboration software from WESEEK Japan. An input validation error vulnerability exists in the login process in WESEEK GROWI 3.4.6 and prior versions. The vulnerability originates from a network system or product that does not properly validate input data. An...

Open redirect

IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to...

PT-2019-16960 · Ibm · Ibm Jazz For Service Management

Name of the Vulnerable Software and Affected Versions: IBM Jazz for Service Management versions 1.1.3 through 1.1.3.2 Description: The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, the attack...

WakaTime: Vulnerability Name: Host Header Injection Redirect

Vulnerability Description: Open redirection is sometimes used as a part of phishing attacks that confuse visitors about which web site they are visiting. Remediation: If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this...

WordPress 4DMayi 4.6 Open Redirection

Exploit Title : WordPress 4DMayi Themes 4.6 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/05/2019 Vendor Homepage : zmingcx.com Information Link : zmingcx.com/begin.html WordPress Version : 4.9.10 Theme Version : 4.6 Category : WebApps...

WordPress Aliyun 5.2 Open Redirection

Exploit Title : WordPress Aliyun Themes 5.2 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 23/05/2019 Vendor Homepage : aliyunhelp.com - zmingcx.com Version : WordPress Version 4.9.10 - Theme Version 5.2 Tested On : Windows and Linux Category :...

WordPress Howsci 1.8 Open Redirection

Exploit Title : WordPress Howsci Themes 1.8 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 24/05/2019 Vendor Homepage : howsci.com Theme Affected Version : 1.8 WordPress Affected Version : 4.9.10 Information Link : howsci.com/tag/themes/ Tested...

Staying Cyber Safe During Memorial Day

As Memorial Day approaches, the Cybersecurity and Infrastructure Security Agency CISA reminds users to stay cyber safe. Users should be cautious of potential scams, such as unsolicited emails that contain malicious links or attachments with malware. Users should also be aware of the risks...

CVE-2019-5946

Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the Login Screen...

CVE-2019-5955

CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access an arbitrary website via vulnerable application and conduct phishing attacks...

Authentication flaw

CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access an arbitrary website via vulnerable application and conduct phishing attacks...

CVE-2019-5955

The CVE-2019-5955 issue concerns the CREATE SD official App for Android (version 1.0.2 and earlier). The root cause is an improper access control vulnerability (CWE-284) in how the app handles Intents, enabling a remote attacker to craft an interaction that directs a user to an arbitrary URL. Thi...