CVE-2021-29250

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...

PT-2021-18145

Name of the Vulnerable Software and Affected Versions: BTCPay Server versions 1.0.0 through 1.0.7.0 Description: The issue is related to a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This vulnerability enables cookie stealing. Recommendations: For BTCP...

CVE-2021-29250: Improper Neutralization of Input During Web Page Generation

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...

WeSteal: A Cryptocurrency-Stealing Tool That Does Just That

Some cybercriminals try, at least, to cover their dirty work with a threadbare “this will throw off the lawsuits” blanket of legitimacy. For example, phone-tracking tools that silently install and operate and which are supposedly meant for parents to legally watch out for their kids in actuality,...

ToxicEye RAT hits Telegram app to spy, steal user data

By Habiba Rashid ToxicEye is a new remote access Trojan RAT malware targeting Telegram app users - The RAT has been used for more than 130 attacks over the past three months. This is a post from HackRead.com Read the original post: ToxicEye RAT hits Telegram app to spy, steal user data...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

Cross-site Scripting (XSS) - Generic in forkcms/forkcms

✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publishondate" Parameter 🕵️‍♂️ Proof of Concept Vulnerable parameter: publishondate XSS payload: '"%26%25alert1 Steps to reproduce issue 1- Login to Fork admin panel 2-...

Hotel And Lodge Management System 1.0 - (Customer Details) Stored XSS Vulnerability

Exploit Title: Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS Exploit Author: Jitendra Kumar Tripathi Vendor Homepage: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html Software Link:...

Bogus Android Clubhouse App Drops Credential-Swiping Malware

Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers malware that steals login credentials for more than 450 apps. Clubhouse has burst on the social media scene over the past few months, gaining hype through its audio-chat rooms where participants can...

Tutor LMS for WordPress Open to Info-Stealing

Security vulnerabilities in Tutor LMS, a WordPress plugin installed on more than 20,000 sites, open the door to information theft and privilege escalation, according to researchers. Tutor LMS is a learning-management system for educators that allows them to digitally reach their students. It...

Hackers Now Hiding ObliqueRAT Payload in Images to Evade Detection

Cybercriminals are now deploying remote access Trojans RATs under the guise of seemingly innocuous images hosted on infected websites, once again highlighting how threat actors quickly change tactics when their attack methods are discovered and exposed publicly. New research released by Cisco Tal...

Threat Source newsletter (Feb. 25, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We all think of APTs as these wide-reaching, silent threat groups who are backed by a nation-state. But our recent research into Gamaredon shows that not all APTs are created equal. We’ve spotted this actor carrying out several...

Microsoft Lures Populate Half of Credential-Swiping Phishing Emails

Almost half of phishing attacks in 2020 aimed to swipe credentials using Microsoft-related lures – from the Office 365 enterprise service lineup to its Teams collaboration platform. According to a Tuesday report by Cofense, which analyzed millions of emails related to various attacks, 57 percent...

CVE-2020-35592

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie...

CVE-2021-27190

A Stored Cross Site ScriptingXSS Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can ste...

CVE-2021-27190

A Stored Cross Site ScriptingXSS Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can ste...

LodaRAT Windows malware now hunting Android devices

By Deeba Ahmed Dubbed LodaRAT, the trojan was equipped with credential-stealing capabilities earlier, but now it is eyeing Android users. This is a post from HackRead.com Read the original post: LodaRAT Windows malware now hunting Android devices...

LodaRAT Windows Malware Now Also Targets Android Devices

A previously known Windows remote access Trojan RAT with credential-stealing capabilities has now expanded its scope to set its sights on users of Android devices to further the attacker's espionage motives. "The developers of LodaRAT have added Android as a targeted platform," Cisco Talos...

Revive Adserver: Reflected XSS on /admin/stats.php

Linked to the report https://hackerone.com/reports/1083376 I found a reflected XSS attack on /admin/stats.php. Revive-Adserver version is revive-adserver-5.1.1. This time I found the parameter statsBreakdown - Go to...