Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

CVE-2018-3014

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications subcomponent: Reports. The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Buffer overflow

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications subcomponent: Reports. The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.

Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...

Design/Logic Flaw

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2427

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2427

SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...

CVE-2018-2427

Public documents in the provided set do not disclose detailed technical specifics (affected components, root cause, or remediation) for CVE-2018-2427. Monitor for updates.

FreeBSD : zziplib - multiple vulnerabilities (7764b219-8148-11e8-aa4d-000e0cd7b374)

NIST reports by search in the range 2017/01/01 - 2018/07/06 : 17 security fixes in this release : - Heap-based buffer overflow in the zzipget32 function in fetch.c. - Heap-based buffer overflow in the zzipget64 function in fetch.c. - Heap-based buffer overflow in the zzipmementryextrablock functi...

ThreatList: Virtualization-related Bug Reports Jump 275 Percent in 2018

Zero Day Initiative said Monday that so far in 2018, it has published 600 advisories – up 33 percent from the 451 published in 2017, which was previously its “busiest year ever.” “Interestingly, we had fewer advisories released as 0-day this year,” the company said in its mid-year report on...

Sn1per v5.0 - Automated Pentest Recon Scanner

Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage...

Security Bulletin: Cross Site Scripting (XSS) vulnerability affects Cognos Analytics

Summary Cognos Analytics is vulnerable to a XSS attack when executing a report. Vulnerability Details CVEID: CVE-2016-3032 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM Algo One ARA reports can be accessed by another user

Summary IBM Algorithmics One-Algo Risk Application could allow a user to gain access to another user's reports using a specially crafted HTTP request. Vulnerability Details IBM Algorithmics One-Algo Risk Application could allow a user to gain access to another user's reports using a specially...

Multiple Vulnerabilities in MySQL Smart Reports 'id'

MySQL Smart Reports is a complete solution for generating reports using existing MySQL databases. An attacker can exploit this vulnerability to execute arbitrary SQL commands. A SQL injection and cross-site scripting vulnerability exists in MySQL Smart Reports 'id'. An attacker can exploit this...

Microsoft Windows: Service: Problem Reports and Solutions Control Panel Support

The service SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.109268";...

WordPress WooCommerce Quick Reports plugin <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Security Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.7. Solution 11 June 2018 - we were unable to find an updated version or its changelog...

WordPress MULTIDOTS WooCommerce Quick Reports Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. MULTIDOTS WooCommerce Quick Reports plugin is used in one of the e-commerce order report generation plugin...

WordPress WooCommerce Quick Reports plugin <= 1.0.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.6. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...