Threat Roundup for July 19 to July 26

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 19 and July 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

CVE-2019-1010235

Frog CMS 1.1 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets...

Cross site scripting

Frog CMS 1.1 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets...

CVE-2019-1010235

Summary of CVE-2019-1010235 : Frog CMS 1.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the Snippets component. The fault is described in CNVD-2019-23999 as a lack of proper validation of client-side data, enabling attackers to execute client-side code. Reported impacts include co...

Metasploit Reverse Session Takeover Vulnerability

Exploit for multiple platform in category local exploits Exploit Title: Metasploit Reverse Session Takeover Exploit Author: Social Engineering Neo - @EngineeringNeo Software Link: https://www.metasploit.com/download Version: Metasploit Pro v4.17.67-dev Tested on: Linux & Windows Metasploit Revers...

WordPress: Stored XSS Vulnerability

Hi there, I found a stored xss @ https://core.trac.wordpress.org/ Steps: 1. Go to https://core.trac.wordpress.org/ and login. open new private window and login with another account 2. Go to https://core.trac.wordpress.org/newticket and set a summary and description. 3. Select a Workflow Keyword a...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

Cross site scripting

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

CVE-2019-1010016 affects Dolibarr 6.0.4 with a Cross-Site Scripting (XSS) vulnerability in the file htdocs/product/stats/card.php. The attack requires a victim to click a specially crafted link sent by the attacker, which can lead to cookie stealing. The provided documents confirm the vulnerable ...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

Agent Smith Android malware has infected 25 million devices so far

By Waqas Agent Smith malware exploits Android vulnerabilities to target unsuspected users for credential stealing. The IT security researchers at CheckPoint have discovered a new variant of smartphone malware whose primary target is Android devices and so far the malware has infected more than 25...

Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack

The prevailing perception about fileless threats, among the security industry’s biggest areas of concern today, is that security solutions are helpless against these supposedly invincible threats. Because fileless attacks run the payload directly in memory or leverage legitimate system tools to r...

What Is Credential Dumping?

Modern network intrusions thrive on a counterintuitive trick: stealing passwords from computers that hackers have already compromised...

New attack spreads LokiBot & NanoCore malware in ISO image files

By Waqas Both NanoCore and LokiBot are Info-stealing Trojans. Security researchers at the San Francisco-based firm Netskope have discovered a new malware campaign distributing the info-stealer malware LokiBot and NanoCore via ISO image file attachments that appear to be an invoice. It is notewort...

Malspam Emails Blanket LokiBot, NanoCore Malware With ISO Files

An ongoing spam campaign has been spotted using ISO disk image file attachments to disguise various information-stealing trojans, including LokiBot and NanoCore. Researchers said that they first spotted the malware-laced spam emails being distributed in April 2019. Spam sent to victims claim to b...

Malicious Package

smartsearchwp is a malicious package. The package contains malicious code that steal credentials from websites it is loaded in when executed. DOM elements are traversed for usernames and passwords, which are subsequently uploaded to a remote server. Port scans of local gateway are performed and...

Malicious Package

Overview All versions of smartsearchwp contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as username and password and uploads it to a remote server. The package also port-scans the local...

New Flaw in WordPress Live Chat Plugin Lets Hackers Steal and Hijack Sessions

Security researchers have been warning about a critical vulnerability they discovered in one of a popular WordPress Live Chat plugin, which, if exploited, could allow unauthorized remote attackers to steal chat logs or manipulate chat sessions. The vulnerability, identified as CVE-2019-12498,...