Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting

Exploit Title: Multiple XSS Oracle WebCenter Sites FatWire Content Server 7.x 11gR1 Dork: inurl:Satellite?c Date: 18.12.201 Exploit Author: Richard Alviarez Vendor Homepage: http://oracle.com Version: 7.x 11gR1 CVE: CVE-2018-2791 Category: Webapps Tested on: Kali linux...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

A look into Drupalgeddon’s client-side attacks

Drupal is one of the most popular Content Management Systems CMS, along with WordPress and Joomla. In late March 2018, Drupal was affected by a major remote code execution vulnerability CVE-2018-7600 followed by yet another CVE-2018-7602 almost a month later, both aptly nicknamed Drupalgeddon 2 a...

RedDawn Espionage Campaign Shows Mobile APTs on the Rise

A sophisticated and targeted mobile espionage campaign has been found targeting North Korean defectors. Mounted by a relatively new APT actor known as Sun Team, the offensive used Google Play and Facebook as attack vectors; and overall, it shows how quickly the mobile threat landscape is evolving...

Blackboard Learn Redirection Vulnerability

Blackboard Learn is a suite of online collaborative learning solutions from Blackboard USA. A security vulnerability exists in versions of Blackboard Learn prior to 10/17/2017. A remote attacker can exploit the vulnerability by constructing a URL that redirects the user's browser to an arbitrary...

Panda Banking Trojan Diversifies into Cryptocurrency, Porn, Other Targets

The Panda banking trojan, a spin-off from the infamous Zeus malware, is widening its net to attack more than just financial services targets, as seen in three ongoing campaigns discovered in May. The Windows-focused Panda is far from the cuddly thing its name would suggest. It has a full arsenal ...

UBUNTU-CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

Google Maps flaw lets hackers redirect users to malicious sites

By Uzair Amir Google Maps users need to stay vigilant as cybercriminals are taking This is a post from HackRead.com Read the original post: Google Maps flaw lets hackers redirect users to malicious sites...

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

CVE-2018-5168

Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects...

Oracle Fusion Middleware WebCenter Sites Component Unauthorized Operation Vulnerability

Oracle Fusion Middleware is Oracle's business innovation platform for enterprise and cloud environments, and WebCenter Sites is a web experience management component that enables marketers and business users to create and manage interactive social online experiences to drive sales and customer...

Tech support scam uses fake Shoppers Stop site to lure thousands

Update 2018-05-17: Shoppers Stop is a legitimate company based out of India and their brand was abused by scammers. These days, there are a lot of browser locker campaigns fueled by malvertising or redirection from hacked sites. But the Shoppers Stop tech scam campaign is actually a bit of both,...

Multiple Cisco WebEx Network Recording Players Remote Code Execution Vulnerabilities

Cisco WebEx Business Suite meeting sites, WebEx Meetings sites, and WebEx Meetings Server are video conferencing solutions from Cisco.WebEx Network Recording Player for WebEx Network Recording Player for Advanced Recording Format ARF is one of the meeting recording players. An input validation...

Cisco WebEx Business Suite meeting sites, WebEx Meetings sites and WebEx Meetings Server code execution vulnerabilities

Cisco WebEx Business Suite WBS31 client, etc. are video conferencing solutions from Cisco USA.WebEx ARF player is one of the players, which is mainly used to play WebEx recorded files in ARF format. An input validation vulnerability exists in WebEx ARF player in multiple Cisco products. A remote...

Cisco WebEx Business Suite meeting sites and WebEx Meetings sites WebEx Recording Format Player information disclosure vulnerability

Cisco WebEx Business Suite meeting sites and WebEx Meetings sites are video conferencing solutions from Cisco.WebEx Recording Format WRF Player is one of the players, which is mainly used to play WRF WebEx Recording Format WRF Player is one of the players, which is mainly used to play the WRF...

CVE-2018-0264

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format ARF files could allow an unauthenticated, remote attacker to execute arbitrary code on the system of a targeted user. An attacker could exploit this vulnerability by sending the user a link or email attachme...

DRUPAL-CONTRIB-2018-022

This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard. The modules DRD and DRD Agent encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize...

PT-2018-16244 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 9.0.1.1049 Description: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader. A specially crafted PDF document can trigger a previously freed object in memory to be reused,...

Flaw in LinkedIn AutoFill Plugin Lets Third-Party Sites Steal Your Data

Not just Facebook, a new vulnerability discovered in Linkedin's popular AutoFill functionality found leaking its users' sensitive information to third party websites without the user even knowing about it. LinkedIn provides an AutoFill plugin for a long time that other websites can use to let...