740 matches found
CVE-2021-27930
Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated or compromised user to inject malicious JavaScript in folder/file name within the application in order to grab other users’ sessions or execute malicious code in their browsers 1-click RCE...
Netgear Authentication Bypass Allows Router Takeover
Netgear has patched three bugs in one of its router families that, if exploited, can allow threat actors to bypass authentication to breach corporate networks and steal data and credentials. Microsoft security researchers discovered the bugs in Netgear DGN-2200v1 series routers while they were...
U.S. Dept Of Defense: XSS Reflected - ██████████
Hi Team, I found a XSS Reflected. https://██████████/███onload=%22prompt1 Thanks DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content & even steal cookies. System Host...
GHSA-8F4M-HCCC-8QPH Insertion of Sensitive Information into Log File in ansible
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by nolog feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to dat...
Mediat Cross-Site Scripting Vulnerability
Mediat is a responsive media CMS. A cross-site scripting vulnerability exists in Mediat version 1.4.1, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to inject malicious JavaScript code to steal user credentials...
CiLocks - Android LockScreen Bypass
CiLocks - Android LockScreen Bypass Features Brute Pin 4 Digit Brute Pin 6 Digit Brute LockScreen Using Wordlist Bypass LockScreen Antiguard Not Support All OS Version Root Android Supersu Not Support All OS Version Steal File Reset Data Required - Adb Android SDK - Cable Usb - Android Emulator...
ProjectWorlds College Management System 跨站脚本漏洞
Project Worlds Online Examination System is an online examination system. version 1.0 of ProjectWorlds College Management System is vulnerable to a cross-site scripting vulnerability that could be exploited to inject malicious JavaScript code to execute and steal user credentials...
Gris CMS 跨站脚本漏洞
Gris CMS is a flat file CMS for developers and Markdown enthusiasts. A cross-site scripting vulnerability exists in Gris CMS v0.1, which stems from a lack of proper validation of client data in the web application, and can be exploited by an attacker to inject malicious JavaScript code to steal...
Microsoft shares details of malware attack on aerospace, travel sector
By Habiba Rashid The malware allows attackers to steal credentials, take screenshots, webcam data, browser, clipboard data, system, and network info. This is a post from HackRead.com Read the original post: Microsoft shares details of malware attack on aerospace, travel sector...
IBM Jazz Foundation 跨站脚本漏洞
IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines Corporation IBM. IBM Jazz Foundation suffers from a cross-site scripting vulnerability that allows a user to embed arbitrary JavaScript code in the Web UI, which c...
Mozilla: Malicious extensions could have spoofed popup information
The Mozilla Foundation Security Advisory describes this issue as: A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website...
Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS
Exploit Title: Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS Exploit Author: Jitendra Kumar Tripathi Vendor Homepage: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html Software Link:...
Hackers steal $3.8 million from Defi Protocol DODO
By Habiba Rashid DODO is a decentralized exchange built on the proactive market maker algorithm that runs on Ethereum and Binance Smart Chain BSC This is a post from HackRead.com Read the original post: Hackers steal $3.8 million from Defi Protocol DODO...
Malicious Package
Overview paychex-app-common-html is a malicious package. It uses a preinstall script to steal environment variables. Remediation Avoid using all malicious instances of the paychex-app-common-html package. Credit: Snyk Research...
Malicious Package
Overview paychex-framework-core-ui is a malicious package. It uses a preinstall script to steal environment variables. Remediation Avoid using all malicious instances of the paychex-framework-core-ui package. Credit: Snyk Research...
U.S. Dept Of Defense: Reflected XSS in https://██████████ via "████████" parameter
Hello Security Team, I would like to report the XSS vulnerability on your system. The ██████████ parameter is not escaped properly for URL encoded values. ██████ Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user...
N. Korean Hackers Targeting Security Experts to Steal Undisclosed Researches
Google on Monday disclosed details about an ongoing campaign carried out by a government-backed threat actor from North Korea that has targeted security researchers working on vulnerability research and development. The internet giant's Threat Analysis Group TAG said the adversary created a...
Winmail Cross-Site Scripting Vulnerability
Winmail is a server-side application used to provide mail services by Suzhou Huazhao Technology Winmail Company in China. A cross-site scripting vulnerability exists in Winmail version 6.5. An attacker can exploit this vulnerability to steal sensitive information...
GitLab 授权问题漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An Access Control Error vulnerability exists in GitLab...
