Mail.ru: Subdomain takeover on "info-edcrunch.skillfactory.ru"

Domain, site, application -- http://info-edcrunch.skillfactory.ru/ Here there is a skillfactory domain info-edcrunch.skillfactory.ru which is pointing towards tilda pages so this domain can be taken over can can be used to do any type of attacks mostly i can make a fake login page on your behalf...

RHEL 8 : kernel-rt (RHSA-2020:2171)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2171 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Cross-site Scripting (XSS)

firefox is vulnerable to cross-site scripting XSS. The vulnerability exists through a flaw in Firefox that allowed the address bar to display a different website than the one the user was visiting. An attacker could use this flaw to conceal a malicious URL, possibly tricking a user into believing...

Cross-site Scripting (XSS)

squirrelmail is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could inject arbitrary Javascript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL...

CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

Design/Logic Flaw

There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007...

Mozilla Firefox has an unspecified vulnerability (CNVD-2019-17484)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 67. An attacker can exploit the vulnerability to spoof pages and trick users into installing malicious extensions...

Remote code execution

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary...

Microsoft Excel Information Disclosure Vulnerability (CNVD-2019-02778)

Microsoft Excel is a spreadsheet processing software in the Office suite of Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel. An attacker can exploit this vulnerability by tricking a user into opening a specially crafted document to obtain sensitive information...

Indian police & Microsoft busts tech support scam centers

By Uzair Amir You may have watched YouTube videos about tech support scam tricking unsuspecting users into believing that their devices have been compromised with some nasty malware and the only way to get rid of it is to pay the technician for their "services" over the phone or Skype call. This...

Code injection

RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious co...

LeakVM - Research & Pentesting Framework For Android, Run Security Tests Instantly

LeakVM: Run security tests instantly. Why LeakVM : LeakVM fast security test on Android, by skipping the time-consuming build pen-testing laboratories, you can test on real devices or virtual devices. LeakVM makes researchers and pen-testers more productive since they can run the test on real tim...

CVE-2017-8164

Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-L09C576B150; EVA-L09C635B221; EVA-L09C636B193; EVA-L09C675B130; EVA-L09C688B143; EVA-L09C703B160; EVA-L09C706B145; EVA-L09GBRC555B171;...

CVE-2018-7254

An out-of-bounds read flaw was found in the way WavPack handled processing of CAF Core Audio Format files. An attacker could potentially use this flaw to crash WavPack by tricking it into processing crafted CAF files...

CVE-2017-4951

VMware AirWatch Console 9.2.x before 9.2.2 and 9.1.x before 9.1.5 contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices...

Mozilla Firefox Private Browsing Mode Security Bypass Vulnerability

Mozilla Firefox is a popular WEB browser. A security bypass vulnerability exists in Mozilla Firefox Private Browsing mode, which can be exploited by a remote attacker to submit a special WEB page that can be tricked into parsing by the user, bypassing security restrictions and performing...

CVE-2017-3157

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user in...

[ASA-201709-16] ettercap: multiple issues

Arch Linux Security Advisory ASA-201709-16 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-6430 CVE-2017-8366 Package : ettercap Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-212 Summary ======= The package ettercap befo...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-12107)

Microsoft Edge is a web browser developed by Microsoft USA and is the default browser that comes with the Windows 10 operating system. An information disclosure vulnerability exists in Microsoft Edge. An attacker can exploit this vulnerability to obtain sensitive information by tricking users int...

WordPress Plugin Instagram Feed Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress plugin Instagram Feed. An attacker exploiting the...