CVE-2017-1000443

Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code execution in the browser...

CVE-2017-1000443

The CVE-2017-1000443 entry concerns Eleix Openhacker version 0.1.47, with a Cross-Site Scripting (XSS) vulnerability in the bank transactions component. The issue enables arbitrary code execution in the browser when the vulnerable bank transactions functionality is processed, as described in the ...

PT-2018-5214

Name of the Vulnerable Software and Affected Versions Eleix Openhacker version 0.1.47 Description The issue concerns a XSS vulnerability in the bank transactions component, allowing for arbitrary code execution in the browser. Recommendations For Eleix Openhacker version 0.1.47, consider disablin...

CVE-2017-1000443: Improper Neutralization of Input During Web Page Generation

Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code execution in the browser...

Forever 21 Confirms Security Breach Exposed Customer Credit Card Details

First notified in November of a data breach incident, popular clothing retailer Forever 21 has now confirmed that hackers stole credit card information from its stores throughout the country for several months during 2017. Although the company did not yet specify the total number of its customers...

4 Years After Target, the Little Guy is the Target

Dec. 18 marked the fourth anniversary of this site breaking the news about a breach at Target involving some 40 million customer credit and debit cards. It has been fascinating in the years since that epic intrusion to see how organized cyber thieves have shifted from targeting big box retailers ...

sbicard.com XSS vulnerability

Vulnerable URL: https://www.sbicard.com/en/search.page?q=how%2520can%2520i%2520check%2520the%2520transactions%2520on%2520my%2520sbi%2520cardalert'OpenBugBounty'...

How cryptocurrency mining works: Bitcoin vs. Monero

Ever wondered why websites that are mining in the background don’t mine for the immensely hot Bitcoin, but for Monero instead? We can explain that. As there are different types of cryptocurrencies, there are also different types of mining. After providing you with some background information abou...

Are you ready for the holidays?

It's November, which means the holiday season is upon us and retailers are working tirelessly to get their websites, apps and infrastructures ready to deliver a secure and exceptional customer experience during the peak holiday season. If past data is any indication of things to come, 2017 promis...

Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

Sonic Drive-In, a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in...

Secure E-Commerce Script 1.02 SQL Injection

Exploit Title: Secure E-commerce Script v1.02 - SQL Injection Date: 2017-09-22 Exploit Author: 8bitsec Vendor Homepage: http://www.phpscriptsmall.com/ Software Link: http://www.phpscriptsmall.com/product/secure-e-commerce-script/ Version: 1.02 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email:...

Microsoft Launches Ethereum-Based 'Coco Framework' to Speed Up Blockchain Network

A growing number of enterprises are showing their interest in blockchains, but the underlying software fails to meet key enterprise requirements like performance, confidentiality, governance, and required processing power. However, Microsoft wants to help solve these issues and make it easier for...

BadIntent - Intercept, Modify, Repeat and Attack Android's Binder Transactions Using Burp Suite

BadIntent is the missing link between the Burp Suite and the core Android's IPC/Messaging-system. BadIntent consists of two parts, an Xposed-based module running on Android and a Burp-plugin. Based on this interplay, it is possible to use the Burp's common workflow and all involved tools and...

Hackers Behind WannaCry Ransomware Withdraw $143,000 From Bitcoin Wallets

The cyber criminals behind the global WannaCry ransomware attack that caused chaos worldwide have finally cashed out their ransom payments. Nearly three months ago, the WannaCry ransomware shut down hospitals, telecom providers, and many businesses worldwide, infecting hundreds of thousands of...

The real problem with ransomware

Ransomware – a specialized form of malware that encrypts files and renders them inaccessible until the victim pays a ransom – is an extremely serious problem and it’s quickly getting worse. The FBI estimated that ransomware payments were $1 billion in 2016, up from “just” $24 million a year...

[SECURITY] Fedora 24 Update: libdb-5.3.28-24.fc24

The Berkeley Database Berkeley DB is a programmatic toolkit that provides embedded database support for both traditional and client/server applications. The Berkeley DB includes B+tree, Extended Linear Hashing, Fixed and Variable-length record access methods, transactions, locking, logging, share...

Denial Of Service (DoS)

github.com/chain/chain is vulnerable to denial of service DoS attacks. The attacks exist because it does not validate the json in the reference data when indexing transactions, thereby allowing a malicious user to create transactions with any invalid or untrusted json...

Mozilla: Use-after-free during transaction processing in the editor (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Xen Hypervisor xenstored Write Saturation DoS (XSA-206)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability in xenstored during processing of transactions. An attacker on the guest can exploit this vulnerability by issuing repeated writes to xenstore that...

Lazarus APT Spinoff Linked to Banking Hacks

SINT MAARTEN—The Lazarus Group, a nation-state level of attacker tied to the 2014 attacks on Sony Pictures Entertainment, has splintered off a portion of its operation to concentrate on stealing money to fund itself. The group, widely believed to be North Korean, has been linked to a February 201...