1618 matches found
SEC charges dark web user of insider trading, money laundering
By Deeba Ahmed The accused is a Greek national who used AlphaBay marketplace with the alias "The Bull" on the dark web for insider trading information. This is a post from HackRead.com Read the original post: SEC charges dark web user of insider trading, money laundering...
First American Financial Pays Farcical $500K Fine
In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. NYSE:FAF was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back 16 years. This week, the U.S...
The vulnerability of Belden Hirschmann HiOS and HiSecOS operating systems lies in the insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of Belden Hirschmann HiOS and HiSecOS lies in the insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Huawei EulerOS: Security Advisory for isula-sec (EulerOS-SA-2021-1928)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for isula-sec (EulerOS-SA-2021-1949)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP9 : isula-sec (EulerOS-SA-2021-1928)
According to the version of the isula-sec package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially...
Regular Expression Denial Of Service (ReDoS)
ws is vulnerable to regular expression denial of service. An attacker is able to cause excessive CPU consumption that can lead to an application crash by submitting a malicious value of Sec-Websocket-Protocol...
Regular Expression Denial of Service
Overview In ws before versions 5.2.3, 6.2.2 and 7.4.6 there is a ReDOS vulnerability. Impact A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. Proof of concept js for const length of 1000, 2000, 4000, 8000, 16000, 32000 const value ...
CVE-2021-32640
A flaw was found in nodejs-ws. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. Mitigation In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the...
Cross site request forgery (csrf)
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in email protected...
3.6 bug fix and enhancement update
An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...
SIS-REWE GO 7.5.0/12C Cross Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-site Scripting Vulnerabilities product: SIS Informatik - REWE GO vulnerable version: 7.5.0/12C fixed version: 7.7 SP17 CVE number: CVE-2021-31537 impact:...
Debian DLA-2652-1 : unbound1.9 security update
Several security vulnerabilities have been discovered in Unbound, a validating, recursive, caching DNS resolver, by security researchers of X41 D-SEC located in Aachen, Germany. Integer overflows, assertion failures, an out-of-bound write and an infinite loop vulnerability may lead to a denial of...
Design/Logic Flaw
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...
CVE-2021-31803
CVE-2021-31803 affects cPanel prior to 94.0.3, enabling a self‑XSS via the EasyApache 4 Save Profile (SEC-581). The issue lies in saving a configuration file without adequately filtering user input, allowing an attacker to inject JavaScript. Affected component/flow is the EasyApache 4 Save Profil...
CVE-2021-25327
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
Cross site request forgery (csrf)
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
CVE-2021-25327
Skyworth Digital Technology RN510 V.3.1.0.4 contains a cross-site request forgery CSRF vulnerability in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp. Missing CSRF protection in devices can lead to XSRF, as the above pages are vulnerable to cross-site scripting XSS...
SKYWORTH Digital Technology RN510 跨站脚本漏洞
The RN510 is a dual-band wireless AC2100 access point from Skyworth Digital Technology. A cross-site request forgery vulnerability exists in /cgi-bin/net-routeadd.asp and /cgi-bin/sec-urlfilter.asp in the Skyworth Digital Technology RN510 version V.3.1.0.4. No detailed vulnerability details are...