QIWI: account takeover https://qiwi.me

It was possible to takeover user account by sending wrong code parameter in /sms/confirm request. Problem is that code didn't have relation with current user session...

WordPress booking-sms plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress booking-sms plugin. An attacker can exploit this...

Cisco IOS XE Software Short Message Service Denial of Service Vulnerability

According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected...

Cisco IOS Short Message Service Denial of Service Vulnerability

According to its self-reported version, the installed Cisco IOS Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected device...

CVE-2017-18555

The booking-sms plugin before 1.1.0 for WordPress has XSS...

CVE-2017-18555

The booking-sms plugin before 1.1.0 for WordPress has XSS...

Cross site scripting

The booking-sms plugin before 1.1.0 for WordPress has XSS...

CVE-2017-18555

The booking-sms plugin before 1.1.0 for WordPress has XSS...

CVE-2017-18555

The CVE-2017-18555 entry corresponds to a cross-site scripting (XSS) vulnerability in the WordPress Booking-SMS plugin. Multiple sources (Red Hat, CNVD, NVD, CVE lists) confirm that the vulnerability affects the Booking-SMS plugin before version 1.1.0 and can be triggered in user-controlled input...

CVE-2017-18495

The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS...

CVE-2017-18489

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...

Cross site scripting

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...

CVE-2017-18489

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...

CVE-2017-18489

CVE-2017-18489 affects the WordPress plugin Contact Form 7 SMS Addon prior to v2.4.0. The vulnerability is a reflected XSS in the file that prints the GET parameter 'to' (vulnerability in plugins/clockwork-two-factor-authentication/templates/clockwork-test-message.php per PoC). Exploitation targe...

CVE-2017-18495

The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS...

CVE-2017-18495

The connected records confirm CVE-2017-18495 affects the Gravity Forms SMS Notifications plugin for WordPress, with a cross-site scripting (XSS) vulnerability in versions prior to 2.4.0. The issue arises from insufficient validation of client-side data, enabling an attacker to execute client-side...

Cerberus: A New Android 'Banking Malware For Rent' Emerges

After a few popular Android Trojans like Anubis, Red Alert 2.0, GM bot, and Exobot, quit their malware-as-a-service businesses, a new player has emerged on the Internet with similar capabilities to fill the gap, offering Android bot rental service to the masses. Dubbed "Cerberus ," the new remote...

A week in security (August 5 – 11)

Last week on Malwarebytes Labs, we explained how brain-machine interface BMI technology could usher in a world of Internet of Thoughts, why having backdoors is problematic, and how we can improve the security of our smart homes. To cap off Hacker Summer Camp week, the Labs team released a special...

The Fully Remote Attack Surface of the iPhone

Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as...

Android Ransomware Spreads Via 'Sex Simulation Game' Links on Reddit, SMS

Researchers are warning of a new Android ransomware being spread via links in online forums and SMS messages. The malicious links purport to connect back to a sex simulation game, but in reality lead to ransomware that encrypts victims’ files. The Android ransomware, dubbed Android/Filecoder.C, h...