Oracle WebCenter Sites Multiple Vulnerabilities (July 2019 CPU)

Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities : - A deserialization vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Advanced UI Apache Groovy due to a lack of isolation of object...

Oracle WebCenter Sites Information Disclosure Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collections, and more. WebCenter Sites is a Web experience management component that enables marketers and...

Oracle WebCenter Sites Multiple Vulnerabilities (April 2020 CPU)

Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities. - Component: Advanced UI jQuery. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2020-2739

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: Advanced UI. The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites...

CVE-2020-2739

Oracle WebCenter Sites (component: Advanced UI) in Fusion Middleware, version 12.2.1.3.0, is affected by CVE-2020-2739. Multiple sources confirm an unauthenticated attacker with network access over HTTP can compromise the product, with human interaction required for exploitation; impact includes ...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.7.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

Oracle WebCenter Sites Multiple Vulnerabilities (April 2019 CPU)

Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Advanced UI version 12.2.1.3.0 is vulnerable to multiple vulnerabilities. - A vulnerability exists that could allow a remote attacker with network access over HTTP to to compromise Orable WebCenter Sites. This could result...

How Just Visiting A Site Could Have Hacked Your iPhone or MacBook Camera

If you use an Apple iPhone or a MacBook, we have a piece of alarming news for you. Turns out merely visiting a website — not just malicious but also legitimate sites unknowingly loading malicious ads as well — using Safari browser could have let remote attackers secretly access your device's...

Lock and Code S1Ep3: Dishing on data privacy with Adam Kujawa

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Adam Kujawa, a director of Malwarebytes Labs, about the state of data privacy today, including how users and businesses can protect sensitive information...

Watch Out: Android Apps in Google Play Store Capitalizing on Coronavirus Outbreak

Preying on public fears, the ongoing coronavirus outbreak is proving to be a goldmine of opportunity for attackers to stage a variety of malware attacks, phishing campaigns, and create scam sites and malicious tracker apps. Now in a fresh twist, third-party Android app developers too have begun t...

Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission

The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.6.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

Rocket Loader skimmer impersonates CloudFlare library in clever scheme

Update: The digital certificate issued for https.ps has been revoked by GlobalSign. Fraudsters are known for using social engineering tricks to dupe their victims, often times by impersonating authority figures to instill trust. In a recent blog post, we noted how criminals behind Magecart skimme...

Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Data Modification and Deletion

The estimated 2,000+ sites running the plugin are vulnerable to Unauthenticated Data Modification and Deletion, including the potential to delete the entire contents of any table in a vulnerable site’s database...

The vulnerability of the “_failure_path” data input field on the software platform for developing and managing web applications in Symfony allows a perpetrator to gain unauthorized access to information or execute arbitrary code.

The vulnerability of the “failurepath” data input field on the software platform for developing and managing web applications in Symfony involves redirecting to an unauthorized website. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to information or execute...

ISPConfig SQL Injection Vulnerability

ISPConfig is an open source web hosting management program for Linux with a Web control panel , you can use the Web control panel to manage web hosting , open a website , open a mailbox , open and manage mysql databases , support for DNS resolution and monitor the server's operating conditions an...

CVE-2020-9398

ISPConfig before 3.1.15p3, when the undocumented reverseproxypanelallowed=sites option is manually enabled, allows SQL Injection...

CVE-2014-9617

Open redirect vulnerability in remotereporter/loadlogfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

Small Tax-Preparation Firms at Higher Risk this Tax Season, Report

This tax season crooks are targeting users with a new crop of scams that include leveraging remote desktop software and compromising small tax-prep company websites. “If you have the word ‘tax’ in your domain name; you’re a target this year,” warns Sherrod DeGrippo, senior director of threat...

Virtual Freer 1.58 - Remote Command Execution

Exploit title : Virtual Freer 1.58 - Remote Command Execution Exploit Author : SajjadBnd Date : 2020-02-17 Vendor Homepage : http://freer.ir/virtual/ Software Link : http://www.freer.ir/virtual/download.php?action=get Software Linkmirror : http://dl.nuller.ir/virtualfreerv1.58NuLLeR.iR.zip Tested...