IDOR make users can delete others' subscription

Proof of Concept 1 user1 create subscription1 2 user2 create subscription2 3 user2 delete subscription2 4 user2 use burpsuite hiajck the request 5 the request URL can be DELETE /inlong/manager/api/consume/delete/2 6 change the request :DELETE /inlong/manager/api/consume/delete/1 1 is the id of...

New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers

A novel credential-stealing malware called Zaraza bot is being offered for sale on Telegram while also using the popular messaging service as a command-and-control C2. "Zaraza bot targets a large number of web browsers and is being actively distributed on a Russian Telegram hacker channel popular...

WordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Software Email Subscription Popup Type Plugin Vulnerable versions = 1.2.16 Fixed in 1.2.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30489 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1c9d307f1d96 Credits...

Description of the security update for SharePoint Server Subscription Edition: April 11, 2023 (KB5002375)

None None...

Security Updates for Microsoft SharePoint Server Subscription Edition (March 2023)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by a Sharepoint server spoofing vulnerability. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

How the cops buy a "God view" of your location data, with Bennett Cyphers: Lock and Code S04E09

The list of people and organizations that are hungry for your location data--collected so routinely and packaged so conveniently that it can easily reveal where you live, where you work, where you shop, pray, eat, and relax--includes many of the usual suspects. Advertisers, obviously, want to sen...

Researchers Uncover Thriving Phishing Kit Market on Telegram Channels

In yet another sign that Telegram is increasingly becoming a thriving hub for cybercrime, researchers have found that threat actors are using the messaging platform to peddle phishing kits and help set up phishing campaigns. "To promote their 'goods,' phishers create Telegram channels through whi...

[SECURITY] Fedora 37 Update: rubygem-activerecord-7.0.4.3-1.fc37

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties database tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

Big changes to Twitter verification: How to spot a verified account

Twitter has made some fairly major changes to how its verified checkmark status works, and its already causing some confusion. If you rely on the checkmark symbol for confirmation that the individual or business tweeting is actually the real deal, your regular process is now different. How...

[SECURITY] Fedora 38 Update: rubygem-activerecord-7.0.4.3-1.fc38

Implements the ActiveRecord pattern Fowler, PoEAA for ORM. It ties database tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL...

Changes to Citrix Workspace Standard and ShareFile Content Collaboration in Citrix Workspace Bundles

Effective April 17, 2023, Cloud Software Group has made the decision to end of renewal EoR Citrix Workspace Standard and remove ShareFile Content Collaboration from the Citrix Workspace cloud and on-prem subscriptions. This change is part of our ongoing efforts to enhance our product offerings an...

Nexus: A New Rising Android Banking Trojan Targeting 450 Financial Apps

An emerging Android banking trojan dubbed Nexus has already been adopted by several threat actors to target 450 financial applications and conduct fraud. "Nexus appears to be in its early stages of development," Italian cybersecurity firm Cleafy said in a report published this week. "Nexus provid...

Nexus: A New Rising Android Banking Trojan Targeting 450 Financial Apps

An emerging Android banking trojan dubbed Nexus has already been adopted by several threat actors to target 450 financial applications and conduct fraud. "Nexus appears to be in its early stages of development," Italian cybersecurity firm Cleafy said in a report published this week. "Nexus provid...

Description of the security update for SharePoint Server Subscription Edition: March 14, 2023 (KB5002355)

None None...

Security Updates for Microsoft SharePoint Server Subscription Edition (March 2023)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by a Sharepoint server spoofing vulnerability. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Lottery owner can manipulate the RNG to favour themselves, or other certain participants

Lines of code Vulnerability details The docs state that Chainlink VRF will be used as the source of randomness, whose subscription model is described here. A call is made to Chainlink's VRFCoordinatorV2 requestRandomWords function, after which a response is sent back in the form of a call to...

CVE-2021-36400

CVE-2021-36400 : In Moodle, insufficient capability checks made it possible to remove other users’ calendar URL subscriptions. The connected documents indicate the issue is a permissions flaw within the Moodle calendar subscriptions feature, with the CVSS base score 5.3 (Medium) and a leading imp...

virt-who bug fix and enhancement update

An update is available for virt-who. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virt-who service collects information about the connection between the...

CVE-2022-23240

Active IQ Unified Manager for VMware vSphere, Linux, and Windows versions prior to 9.11P1 is affected. A vulnerability allows unauthorized users to update EMS Subscriptions through unspecified vectors. The affected product is NetApp Active IQ Unified Manager; the root cause and exact exploit path...

CVE-2022-23240

Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorized users to update EMS Subscriptions via unspecified vectors...