GootLoader Hackers Targeting Employees of Law and Accounting Firms

Operators of the GootLoader campaign are setting their sights on employees of accounting and law firms as part of a fresh onslaught of widespread cyberattacks to deploy malware on infected systems, an indication that the adversary is expanding its focus to other high-value targets. "GootLoader is...

Sphinx Technologies Sphinx 路径遍历漏洞

Sphinx Technologies Sphinx is a full-text F/OSS search engine from Sphinx Technologies, USA. Sphinx Technologies Sphinx suffers from a path traversal vulnerability that stems from the discovery that sphinxsearch, a fast standalone full-text SQL search engine, can be allowed to abuse configuration...

A week in security (Dec 6 – 12)

Last week on Malwarebytes Labs: Log4j zero-day “Log4Shell” arrives just in time to ruin your weekend Click “OK” to defeat MFA Fake job interviews plague major game developers like Riot Games and Rockstar Has your WordPress site been backdoored by a skimmer? What is a search engine and why does...

What is a search engine and why does anyone care which one you use?

An attempt at a simple definition: a search engine is a software system that allows users to find content on the Internet based on their input. The introduction of the major search engines brought about huge changes in the way we use the Internet. There is a wealth of knowledge available for thos...

What Microsoft Bing’s IndexNow Means for CDN Users

Microsoft Bing today announced the rollout of IndexNow, a new protocol designed in conjunction with Yandex that can allow “websites to easily notify search engines whenever their website content is created, updated, or deleted.” The goal is to reduce the amount of time it takes for search engines...

CVE-2021-28000

A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields...

CVE-2021-27999

A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database...

CVE-2021-27999

A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database...

CVE-2021-28000

A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields...

Sql injection

A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database...

CVE-2021-28000

A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields...

CVE-2021-27999

CVE-2021-27999 affects Local Services Search Engine Management System Project 1.0. The vulnerability is a SQL injection in the editid parameter that enables admins to dump all data from the database. Exploitation details are not provided beyond the description; no patch/version is specified in th...

Local Services Search Engine Management System 跨站脚本漏洞

Local Services Search Engine Management System is a local services search engine management system. A cross-site scripting vulnerability exists in the Local Services Search Engine Management System Project, which stems from a persistent cross-site scripting vulnerability discovered in the Local...

This New Malware Hides Itself Among Windows Defender Exclusions to Evade Detection

Cybersecurity researchers on Tuesday lifted the lid on a previously undocumented malware strain dubbed "MosaicLoader" that singles out individuals searching for cracked software as part of a global campaign. "The attackers behind MosaicLoader created a piece of malware that can deliver any payloa...

Security Bulletin: One vulnerability in IBM FileNet Content Manager, IBM Content Foundation, IBM FileNet Content Federation Services and IBM FileNet Legacy Content Search Engine (CVE-2014-0114)

Summary A security vulnerability exists in IBM FileNet Content Manager, IBM Content Foundation, IBM FileNet Content Federation Services and IBM FileNet Legacy Content Search Engine. See the individual descriptions for the details. Vulnerability Details CVEID: CVE-2014-0114 CVE-2014-0114...

Voidtools Everything 安全漏洞

Voidtools Everything is a free, personally developed Windows desktop search engine that quickly finds files and directories by name on NTFS volumes. Voidtools Everything suffers from a security vulnerability that stems from an HTTP server containing an HTTP header injection problem. A remote...

A week in security (June 21 – June 27)

Last week on Malwarebytes Labs: Want to stop ransomware attacks? Send the cybercriminals to jail, says Brian Honan: Lock and Code S02E11 Atomic research institute breached via VPN vulnerability Hotel staff bust Hermes SMS scammer with suspiciously large number of cables City of Liège hit by...

Russia bans VyprVPN, Opera VPN services for not complying with blacklist request

Russia's telecommunications and media regulator Roskomnadzor RKN on Thursday introduced restrictions on the operation of VyprVPN and Opera VPN services in the country. "In accordance with the regulation on responding to threats to circumvent restrictions on access to child pornography, suicidal,...

DuckDuckGo’s Quest to Prove Online Privacy Is Possible

The company best known for its search engine is launching a new set of tools aimed at creating an “easy button” for protecting your data online...

Malicious PDFs Flood the Web, Lead to Password-Snarfing

The pushers behind the SolarMarker backdoor malware are flooding the web with PDFs stuffed with keywords and links that redirect to the password-stealing, credential-snarfing malware. Microsoft Security Intelligence said in a Tweet on Friday that the SolarMarker also known as Jupyter makers are...