CVE-2008-5914

An unspecified function in the JavaScript implementation in Apple Safari creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing...

CVE-2005-2602

Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote attackers to obfuscate URIs via a long URI, which causes the address bar to go blank and could facilitate phishing attacks...

CVE-2009-5020

Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2009-3784

Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2025-22499 · Ubtech +1 · Freepass +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue is related to URL redirection to untrusted sites, also known as 'Open Redirect'. This occurs when a web application redirects a user to a URL that is not validated, potentially...

100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads

An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code. "The actor creates websites...

CVE-2025-0133

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The...

CVE-2025-0133

PAN-OS CVE-2025-0133 describes a reflected XSS in the GlobalProtect gateway and portal, exploitable by an authenticated Captive Portal user via a specially crafted link to execute malicious JavaScript in the user’s browser. The primary risk is phishing/credential theft, with limited confidentiali...

CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users

A new global phishing threat called "Meta Mirage" has been uncovered, targeting businesses using Meta's Business Suite. This campaign specifically aims at hijacking high-value accounts, including those managing advertising and official brand pages. Cybersecurity researchers at CTM360 revealed tha...

PT-2025-21210

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS affected versions not specified Description A reflected cross-site scripting XSS issue exists in the GlobalProtect gateway and portal features. This flaw allows the execution of malicious JavaScript within the browser...

Alibaba Cloud Linux 3 : 0149: mod_auth_mellon (ALINUX3-SA-2023:0149)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0149 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-3639: A flaw was found in modauthmellon...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

Austin, USA / Texas, 7th May 2025, CyberNewsWire...

PT-2025-20203 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Zoho CRM with Elementor form versions 1.0.0 through 1.0.7 Description: The issue is related to a URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the formsintegrations Integrations of Zoho CRM with Elementor form, which allo...

PT-2025-20088 · Unknown · Wp Gravity Forms Dynamics Crm

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Dynamics CRM versions 1.1.4 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which allows phishing. This can potentially be exploited to...

PT-2025-20090 · Unknown · Wp Gravity Forms Zendesk

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Zendesk versions 1.1.2 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which can be used for Phishing attacks. Recommendations: For WP...

MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks

The malware loader known as MintsLoader has been used to deliver a PowerShell-based remote access trojan called GhostWeaver. "MintsLoader operates through a multi-stage infection chain involving obfuscated JavaScript and PowerShell scripts," Recorded Future's Insikt Group said in a report shared...

The 3 biggest cybersecurity threats to small businesses

In an online world filled with extraordinarily sophisticated cyberattacks—including organized assaults on software supply chains, state-directed exploitations of undiscovered vulnerabilities, and the novel and malicious use of artificial intelligence AI—small businesses are forced to prioritize a...

State-of-the-art phishing: MFA bypass

Cybercriminals are bypassing multi-factor authentication MFA using adversary-in-the-middle AiTM attacks via reverse proxies, intercepting credentials and authentication cookies. The developers behind Phishing-as-a-Service PhaaS kits like Tycoon 2FA and Evilproxy have added features to make them...

Alleged ‘Scattered Spider’ Member Extradited to U.S.

A 23-year-old Scottish man thought to be a member of the prolific Scattered Spider cybercrime group was extradited last week from Spain to the United States, where he is facing charges of wire fraud, conspiracy and identity theft. U.S. prosecutors allege Tyler Robert Buchanan and co-conspirators...

CVE-2025-3706

The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...