ClipboardWalletHijacker malware replaces address to steal cryptocurrency

By Waqas The IT security researchers at Qihoo 360 Total Security have discovered This is a post from HackRead.com Read the original post: ClipboardWalletHijacker malware replaces address to steal cryptocurrency...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...

Design/Logic Flaw

DISPUTED Default and unremovable support credentials user:lutron password:integration allow attackers to gain total super user control of an IoT device through a TELNET session to products using the HomeWorks QS Lutron integration protocol Revision M to Revision Y. NOTE: The vendor disputes this ...

total-lokal.de XSS vulnerability

Open Bug Bounty ID: OBB-600800 Description| Value ---|--- Affected Website:| total-lokal.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Bitdefender Total Security Insecure Pipeline Privilege Vulnerability

Bitdefender Total Security is a suite of antivirus programs from the Romanian company Bitdefender. A security vulnerability exists in BitDefender Total Security 2018 version. A local attacker can exploit the vulnerability to cause a denial of service or gain privileges by emulating all channels...

CVE-2018-6183

BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of an "insecurely created named pipe". Ensures full access to Everyone users group...

CVE-2018-6183

BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of an "insecurely created named pipe". Ensures full access to Everyone users group...

CVE-2018-6183

BitDefender Total Security 2018 is affected by CVE-2018-6183. The issue allows local users to gain privileges or cause a denial of service by impersonating all channels through an insecurely created named pipe, granting full access to the Everyone group. The root cause centers on insecure named p...

RedisWannaMine Unveiled: New Cryptojacking Attack Powered by Redis and NSA Exploits

Recently cryptojacking attacks have been spreading like wildfire. At Imperva we have witnessed it firsthand and even concluded that these attacks hold roughly 90% of all remote code execution attacks in web applications. Having said that, all of the attacks we have seen so far, were somewhat...

Harpoon - CLI Tool For Open Source And Threat Intelligence

OSINT tool, CLI Tool For Open Source And Threat Intelligence Install You can simply pip install the tool: pip3 install git+http://[email protected]/Te-k/harpoon --process-dependency-links Optionally if you want to use the screenshot plugin, you need phantomjs and npm installed: npm install -...

Zomato: [www.zomato.com] Getting a complimentary dessert [Zomato Treats] on ordering a Meal at no cost

Go to order food tab and select any restaurant that delivers online. 2. Add Zomato Treat Subscription to cart. 3. Add more items to cart to fulfil the minimum order requirement for that restaurant. 4. Click on Continue and proceed to pay online. 5. While paying online I faced the issue that...

JBoss 4.2.x/4.3.x - Information Disclosure Exploit

Exploit for multiple platform in category remote exploits Exploit Title: JBoss sensitive information disclosure 4.2X & 4.3.X Exploit Author: JameelNabbo Vendor Homepage: http://www.jboss.org Software Link: http://jbossas.jboss.org/downloads Version: 4.2X. & 4.3.X Tested on: Linux Ubuntu CVE :...

totalserversolutions.com XSS vulnerability

Open Bug Bounty ID: OBB-548518 Description| Value ---|--- Affected Website:| totalserversolutions.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

catalog.totalvideoproducts.com XSS vulnerability

Open Bug Bounty ID: OBB-537286 Description| Value ---|--- Affected Website:| catalog.totalvideoproducts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Japan Total System GroupSession Open Redirect Vulnerability

Japan Total System GroupSession is a groupware project by Japan Total System JTS to facilitate communication among companies and organizations, aiming to promote information sharing. An open redirection vulnerability exists in Japan Total System GroupSession 4.7.0 and earlier versions. An attacke...

JVN#26200083: GroupSession vulnerable to open redirect

GroupSession provided by Japan Total System Co.,Ltd. is an open source groupware. GroupSession contains an open redirect vulnerability CWE-601. Impact When accessing a specially crafted page, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishi...

K7 Total Security Arbitrary Content Read Vulnerability

K7 Total Security is a network security protection device from K7 Computing India. A security vulnerability exists in versions prior to K7 Total Security 15.1.0.305 that stems from the program failing to adequately filter user input. An attacker can exploit the vulnerability to read arbitrary...

CVE-2017-18019

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the...

CVE-2017-18019

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the...

Null pointer dereference

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the...