Exploit for Cross-Site Request Forgery (CSRF) in Webmin

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploit...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31762 |.. Description : Exploiting a Cross-sit...

Exploit for Cross-site Scripting in Webmin

CVE-2021-31761 Description : Exploiting a Reflected Cross-S...

Exploit for Cross-site Scripting in Webmin

..| CVE-2021-31761 |.. Description : Exploiting a Reflected...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

Novel Email-Based Campaign Targets Bloomberg Clients with RATs

A new email-based campaign by an emerging threat actor aims to spread various remote access trojans RATs to a very specific group of targets who use Bloomberg’s industry-based services. Cisco Talos Intelligence researchers discovered the campaign, dubbing it and its perpetrator “Fajan,” and...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration Vulnerability

Exploit Title: Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration Exploit Author: 3ndG4me Vendor Homepage: https://adtran.com/web/page/portal/Adtran/wphome Version: v10.8.1 Tested on: NetVanta 7060 and NetVanta 7100 CVE : CVE-2021-25681 CVE-2021-25681 - AdTran Personal Phone Manager DNS...

Over 750,000 Users Downloaded New Billing Fraud Apps From Google Play Store

Researchers have uncovered a new set of fraudulent Android apps in the Google Play store that were found to hijack SMS message notifications for carrying out billing fraud. The apps in question primarily targeted users in Southwest Asia and the Arabian Peninsula, attracting a total of 700,000...

CVE-2021-25681

AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 706...

CVE-2021-25681

AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 706...

120 Compromised Ad Servers Target Millions of Internet Users

An ongoing malvertising campaign tracked as "Tag Barnakle" has been behind the breach of more than 120 ad servers over the past year to sneakily inject code in an attempt to serve malicious advertisements that redirect users to rogue websites, thus exposing victims to scamware or malware. Unlike...

NitroRansomware Asks for $9.99 Discord Gift Codes, Steals Access Tokens

The NitroRansomware malware strain is shaking up the ransomware norm by demanding Discord Nitro gift codes from victims instead of actual money. Discord is a VoIP, instant messaging and digital-distribution platform designed for creating communities. Users communicate with voice calls, video call...

SUSE: Security Advisory (SUSE-SU-2019:3260-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2016:0173-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:3232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HPESBHF04116 rev.3 - HPE Gen10 and Gen10 Plus Servers, GRUB2 Secure Boot Vulnerability, Local Execution of Arbitrary Code

Potential Security Impact: Local: Execution of Arbitrary Code SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. VMware Upgrade Pack VUP 1.4.1, VUP 1.4.2 - See link to Software Delivery Repository - vibsdepot in Resolution Scripting Toolkit for Linux - Prior to version 11.5121 Apr 20...

SUSE: Security Advisory (SUSE-SU-2015:0939-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nextcloud: Trusted servers exchange can be triggered by attacker

Hi again, So this seems to be less bad these days as the trusted servers are no longer enabled by default however they were some versions ago. The trusted servers exchanged the full user list with another server. As soon as 1 federated share is created between two instances. It is questionable if...

Attackers Target ProxyLogon Exploit to Install Cryptojacker

Cryptojacking can be added to the list of threats that face any unpatched Exchange servers that remain vulnerable to the now-infamous ProxyLogon exploit, new research has found. Researchers discovered the threat actors using Exchange servers compromised using the highly publicized exploit...