4468 matches found
CVE-2021-35493
The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker ...
Cross site scripting
The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker ...
ZLoader’s Back, Abusing Google AdWords, Disabling Windows Defender
A targeted campaign delivering the ZLoader banking trojan is spreading via Google AdWords, and is using a mechanism to disable all Windows Defender modules on victim machines, researchers have found. That’s according to SentinelLabs, which said that to lower the rates of detection, the infection...
CVE-2021-35493
The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker ...
CVE-2021-38150
When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the...
Cross-Site Request Forgery (CSRF) in pheditor/pheditor
Description Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering such as sending a link via email or chat, an attacker may trick the users of a web...
TIBCO WebFOCUS 跨站脚本漏洞
TIBCO WebFOCUS is an enterprise business intelligence and analytics solution from TIBCO USA. Equipped with data management, visual discovery, predictive analytics and powerful visualization capabilities. A security vulnerability exists in TIBCO WebFOCUS Client that allows a low-privileged attacke...
Siemens Simcenter STAR-CCM+ Viewer
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: Simcenter STAR-CCM+ Viewer Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to a crash and allow an attacker to execute code in the context of...
PT-2021-21970 · Sap · Sap Business Client
Name of the Vulnerable Software and Affected Versions: SAP Business Client versions 7.0, 7.70 Description: The issue allows an attacker to read sensitive data, such as credentials, from the local memory or memory dump of a victim, for example, through a social engineering attack. This could enabl...
Honing Cybersecurity Strategy When Everyone’s a Target for Ransomware
These days, ransomware is seemingly ubiquitous. No longer just a discussion topic for cybersecurity professionals and researchers, these days it seems like rarely a week goes by when it’s not in the mainstream media. It’s rapidly become a commonplace word, and in some respects, this increased...
TikTok: Broken Link on TikTokUS.Info
TikTokUS.Info page had a broken link. An attacker could leverage this vulnerability to claim the social media account and perform social engineering attacks such as phishing. We thank @siratsami for reporting this to our team and confirming the resolution...
jenkins: session fixation vulnerability
Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user...
Explanation of the zero-day attack
What is a zero-day vulnerability? A zero-day weakness is an obscure security weakness or programming blemish that a danger entertainer can focus with noxious code. The expression “Zero-Day” is utilized in light of the fact that the product merchant was uninformed of their product weakness, and...
Microsoft Warns of Widespread Phishing Attacks Using Open Redirects
Microsoft is warning of a widespread credential phishing campaign that leverages open redirector links in email communications as a vector to trick users into visiting malicious websites while effectively bypassing security software. "Attackers combine these links with social engineering baits th...
Widespread credential phishing campaign abuses open redirector links
Microsoft has been actively tracking a widespread credential phishing campaign using open redirector links. Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking. Doing so leads to a series of...
Widespread credential phishing campaign abuses open redirector links
Microsoft has been actively tracking a widespread credential phishing campaign using open redirector links. Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking. Doing so leads to a series of...
Delta Electronics DOPSoft (Update A)
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DOPSoft Vulnerability: Stack-based Buffer Overflow 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-238-04 Delta Electronics DOPSoft that was...
Cybersecurity’s next fight: How to protect employees from online harassment
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Leigh Honeywell, CEO and Co-founder of Ta...
Cross-site Scripting (XSS) - Reflected in zoujingli/thinkadmin
✍️ Description The Application is Vulnerable to reflected XSS Attack. 🕵️♂️ Proof of Concept Open the following page in the browser as admin. The 商品名称 field is vulnerable to reflected XSS. An alert box is displayed as PoC...
California Man Hacked iCloud Accounts to Steal Nude Photos
A California man impersonated an Apple customer support technician in a socially engineered email campaign that stole people’s iCloud passwords to break into accounts and collected upwards of 620,000 private photos and videos. Hao Kuo Chi, 40, of La Puente, has agreed to plead guilty to four...