Mail.ru: "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/

Crossite scripting in community.my.games via post comments due to incomplete fix for 848732 I have been working on this issue for 2 hours and over 300 fails. Finally, I could exploit with a very exotic XSS payload. Payload with an emoji a little trick: %F0%9F%98%82!--😂//=...

WordPress Rank Math SEO Plugin < 1.0.41 Multiple REST API Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rankmath:seo"; ifdescription...

CVE-2020-9066

Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169C00E166R4P1 have an improper authentication vulnerability. The Application doesn't perform proper authentication when user performs certain operations. An attacker can trick user into installing a malicious plug-in to exploit...

CVE-2020-8131

An arbitrary file write flaw was found in Yarn. This flaw allows an attacker to write files to a user’s system in unexpected places, potentially leading to remote code execution. The attacker would need to first trick a developer into installing a malicious package...

CMS Made Simple Filemanager Remote Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. Filemanager is one of the file management component . A remote...

Hackers are using Word documents to drop NetSupport Manager RAT

By Sudais Asif Before dropping NetSupport Manager RAT, attackers trick users into opening a malicious MS Word document by entering a password. This is a post from HackRead.com Read the original post: Hackers are using Word documents to drop NetSupport Manager RAT...

sLoad launches version 2.0, Starslord

sLoad, the PowerShell-based Trojan downloader notable for its almost exclusive use of the Background Intelligent Transfer Service BITS for malicious activities, has launched version 2.0. The new version comes on the heels of a comprehensive blog we published detailing the malware’s multi-stage...

SharpHide - Tool To Create Hidden Registry Keys

Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following whitepaper:...

Huawei Emily-L29C Information Disclosure Vulnerability

The Huawei Emily-L29C is a smartphone from the Chinese company Huawei. An information disclosure vulnerability exists in the Huawei Emily-L29C. The vulnerability arises from a configuration or other error in the operation of a network system or product. An attacker can exploit this vulnerability ...

phpBB < 3.2.8 Multiple Vulnerabilities

phpBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpbb:phpbb"; ifdescription...

Cross site scripting

Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway MWG 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully...

Memory Corruption Vulnerability in Delta TPEditor tpe Project File

Delta TPEditor is a HMI programming software. A memory corruption vulnerability exists in the Delta TPEditor tpe project file. An attacker can trick a user who installs TPEditor into opening a malicious tpe file, which in turn triggers the execution of malicious code on the user's system or cause...

Spring Security OAuth - Open Redirector

Spring Security OAuth - Open Redirector Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link: https://spring.io Version: Spring Security OAuth versions 2.3 prior to 2.3.6...

Huawei HG255s Input Validation Error Vulnerability

The Huawei HG255s is a wireless router from Huawei China. A security vulnerability exists in the Huawei HG255s. The vulnerability can be exploited by an attacker to compromise the integrity of the device by tricking a user into clicking on a link...

GitLab: Full access to internal Gitlab instances at redash.gitlab.com, dashboards.gitlab.com, prometheus.gitlab.com

Summary: Lack of proper ticket trick security leads to internal access on Gitlab instances. I did not use support.gitlab.com instead just using [email protected] email was suffice. Description: Getting a [email protected] Google Account After the Ticket Trick attack that Inti reported and...

Microsoft Office Access Connectivity Engine Buffer Error Vulnerability

Microsoft Office is a U.S. Microsoft Microsoft company's office software suite of products. Common components of the product include Word, Excel, Access, Powerpoint, FrontPage, etc. Office Access Connectivity Engine is one of the database connection engine. A remote code execution vulnerability...

Microsoft Browser Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve a...

UBUNTU-CVE-2018-16873

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not ...

Adobe Flash Player Remote Information Disclosure Vulnerability

Adobe Flash Player is a cross-platform, browser-based multimedia player product. A remote information disclosure vulnerability exists in Adobe Flash Player, which allows remote attackers to exploit the vulnerability by submitting a special file request and tricking the user into parsing it, which...

A week in security (October 22 – 28)

Last week on Malwarebytes Labs, we took a look at some new Mac malware, gave you a roundup of 2018 exploit kits, and dispensed some advice on sextortion scams. We also looked at the Cathay Pacific breach, groaned at the revival of an old browser trick, and explained how voting machines and...