boatsandbedzzz.com.au Cross Site Scripting vulnerability OBB-2375581

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Red Cross Hack Linked to Iranian Influence Operation?

A network intrusion at the International Committee for the Red Cross ICRC in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the...

Microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. There is a security vulnerability in Microweber, there is no information about the...

Vicidial 安全漏洞

Vicidial is a software suite from Vicidial, Inc. designed to interact with the Asterisk open source Pbx telephony system as a complete inbound/outbound contact center suite with inbound email support. Vicidial suffers from a cross-site scripting vulnerability that stems from the discovery of a...

MOXA Moxa MXView 安全漏洞

MOXA Moxa MXView is a specialized software for managing networks from MOXA Taiwan, China. The software can be used to configure and process all devices within a network. A security vulnerability exists in Moxa MXView Series, which originates from an information disclosure vulnerability in the web...

Code injection

In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known...

ServiceNow Orlando 安全漏洞

ServiceNow Orlando is a cloud-based platform from US-based ServiceNow, Inc. A security vulnerability exists in ServiceNow Orlando that stems from a password reset form in ServiceNow Orlando that provides different responses to invalid authentication attempts based on the existence of a username...

chatwoot 安全漏洞

chatwoot is a software application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A security vulnerability exists in versions of chatwoot prior to v2.2, which stems from improper permissions management in the GitHub repository prio...

Mahara 安全漏洞

Catalyst It Catalyst IT Mahara is a social networking system from Catalyst IT Catalyst It in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Mahara, which stems from the fact that the name of a folder in the file area can be seen...

Wordpress Administration Panel Login Form Bruteforced

The scanner successfully authenticated on the Wordpress administration panel by using weak or predictable credentials. No source data...

Voltage SecureMail Server Business Logic Bypass

Security Advisory ======================================================================= title: Business Logic Bypass - Mail Relay Post-authenticated product: Voltage SecureMail Server vulnerable version: Voltage SecureMail Server v7.3.0.1 fixed version: Voltage SecureMail Server v7.3.0.1 CVE...

Micro Star International Center 安全漏洞

Micro Star International Center is a new platform from Micro Star Technology Micro Star Inc. of Taiwan, China that combines all of MSI's exclusive features. Micro Star International Center has a security vulnerability that originates from an elevation of privilege vulnerability in multiple...

bmoor 安全漏洞

bmoor is a javascript code library for individual developers to manage the order in which objects and classes are loaded. A security vulnerability exists in versions of bmoor prior to 0.10, which stems from a lack of handling of setup functionality and is susceptible to Prototype Pollution...

Piwigo 安全漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization, and permission management. Piwigo has a security vulnerability that can be exploited by an unauthenticated attacker to take over an account...

CVE-2021-23207

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating user...

LG Smartphone 安全漏洞

The LG Smartphone is a smartphone from the South Korean company LG. The LG Smartphone suffers from a security vulnerability that stems from an issue with the software's AT Command. The vulnerability can be exploited to allow an attacker to reset the device using AT Command during a device reboot...

2FA Bypassed in $34.6M Crypto.com Heist

Early Thursday morning, Crypto.com acknowledged that it had lost $34.65 million worth of cash, Bitcoin and Ethereum after getting ransacked in an attack that slipped fat transactions past two-factor authentication 2FA. Users had complained over the weekend that their accounts had been drained:...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab that stems from issues that have been...

TransCredit exposed financial data of half a million Americans and Canadians

By Waqas TransCredit is a Jacksonville, Florida-based business credit reporting agency for the transportation industry. The IT security researchers at… This is a post from HackRead.com Read the original post: TransCredit exposed financial data of half a million Americans and Canadians...

Attackers Exploit Flaw in Google Docs’ Comments Feature

Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of...