740 matches found
Beijing Jingwei Wisdom Information Technology Co. Jingwei business card app has a logic flaw vulnerability
Jingwei Business Card is a business card entry and business socialization tool for business people launched by Shanglin Huatong. Beijing Jingwei Wisdom Information Technology Co., Ltd Jingwei Business Card app has a logic flaw vulnerability, which can be exploited by an attacker to bind another...
Oracle E-Business Suite Flaws Let Hackers Hijack Business Operations
If your business operations and security of sensitive data rely on Oracle's E-Business Suite EBS , make sure you recently updated and are running the latest available version of the software. In a report released by enterprise cybersecurity firm Onapsis and shared with The Hacker News, the firm...
Hackers use Github bot to steal $1,200 in ETH within 100 seconds
By Sudais Asif Hackers are remotely stealing cryptocurrencies using bots on Github. This is a post from HackRead.com Read the original post: Hackers use Github bot to steal $1,200 in ETH within 100 seconds...
New Android Flaw Affecting Over 1 Billion Phones Let Attackers Hijack Apps
Remember Strandhogg? A security vulnerability affecting Android that malicious apps can exploit to masquerade as any other app installed on a targeted device to display fake interfaces to the users, tricking them into giving away sensitive information. Late last year, at the time of its public...
Weaponizing AWS ECS Task Definitionsto Steal Credentials From Running Containers
The post Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers appeared first on Rhino Security Labs...
Logic flaw vulnerability in Globalvillage ecosystem
Globalvillage ecosystem GVE is a virtual currency system based on blockchain technology.A security vulnerability exists in the 'approveAndCallcode' function in GVE's smart contract implementation, which stems from the program's failure to validate the callcode. The vulnerability can be exploited ...
Chinese Hackers Using New iPhone Hack to Spy On Uyghur Muslims
A Chinese hacking group has been found leveraging a new exploit chain in iOS devices to install a spyware implant targeting the Uyghur Muslim minority in China's autonomous region of Xinjiang. The findings, published by digital forensics firm Volexity, reveal that the exploit — named "Insomnia" —...
Command Injection
postfix is vulnerable to command injection. It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text...
Same-Origin Policy Bypass
firefox is vulnerable to same-origin policy bypass. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim had loaded with Firefox...
CVE-2020-5290 session fixation in rCTF
In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the token=$ssid hash when making a request to the /verify endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim...
Watch Out: Android Apps in Google Play Store Capitalizing on Coronavirus Outbreak
Preying on public fears, the ongoing coronavirus outbreak is proving to be a goldmine of opportunity for attackers to stage a variety of malware attacks, phishing campaigns, and create scam sites and malicious tracker apps. Now in a fresh twist, third-party Android app developers too have begun t...
CVE-2019-19461
Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title...
Cross-site Scripting Vulnerability in Crypto Email System
Crypto Email System is an enterprise-level email system. A cross-site scripting vulnerability exists in Crypto Email System. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...
Unspecified Vulnerability in ABB eSOMS
ABB eSOMS Electronic Shift Operations Management System is a plant operations management system from ABB Switzerland. ABB eSOMS contains a security vulnerability that could be exploited by an attacker to compromise sensitive user information by framing parts of the application on a malicious...
CVE-2019-19293: Improper Neutralization of Input During Web Page Generation
A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...
SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2020-13196)
SAP NetWeaver is SAP's integrated technology platform. A cross-site scripting vulnerability exists in SAP NetWeaver, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessions when malicious data is...
Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2020-10479)
Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform. A cross-site scripting vulnerability exists in Microsoft SharePoint Enterprise Server, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive...
Amazon AWS JavaScript S3 Explorer Cross-Site Scripting Vulnerability
Amazon AWS JavaScript S3 Explorer is a set of S3 browsers. A cross-site scripting vulnerability exists in Amazon AWS JavaScript S3 Explorer explorer.js, which can be exploited by remote attackers to inject malicious script or HTML code, which can be used to gain access to sensitive information or...
U.S. Dept Of Defense: Reflected cross-site scripting vulnerability on a DoD website
Hello there ! I'd like to report a 'XSS' vulnerability on a DoD website https://███/unit/███ , Here in the search engine of the website please enter the following payloads alertdocument.domain & you can even use this payload to steal cookies alertdocument.cookie and hit enter and just scroll you'...
