CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

VideoBytes: Offensive security tools and the bad guys that use them

Hello Folks! In this Videobyte, we’re talking about what penetration testing tools malware gangs love to use and why they are better than what you can get on the black market. This article describes the VirusBulletin talk of a security researcher from Interzer Labs, Paul Litvak, in which he...

CVE-2020-25111

creationtimestamp| type| source ---|---|--- 2020-12-12 02:35:51+00:00| seen| https://t.me/cibsecurity/20650 2020-12-12 02:38:52+00:00| seen| https://t.me/cibsecurity/20670 2020-12-12 03:25:19+00:00| seen| https://t.me/cibsecurity/20690 2020-12-12 04:07:06+00:00| seen| https://t.me/cibsecurity/207...

CVE-2020-15375

creationtimestamp| type| source ---|---|--- 2020-12-12 00:36:03+00:00| seen| https://t.me/cibsecurity/20561 2020-12-12 00:45:55+00:00| seen| https://t.me/cibsecurity/20581 2020-12-12 01:05:11+00:00| seen| https://t.me/cibsecurity/20600 2020-12-12 01:25:19+00:00| seen| https://t.me/cibsecurity/206...

PGMiner, Innovative Monero-Mining Botnet, Surprises Researchers

An innovative Linux-based cryptocurrency mining botnet has been uncovered, which exploits a disputed PostgreSQL remote code-execution RCE vulnerability to compromise database servers. The malware is unusual and completely novel in a host of ways, researchers said. According to researchers at Palo...

CVE-2020-25838

creationtimestamp| type| source ---|---|--- 2020-12-11 07:35:17+00:00| seen| https://t.me/cibsecurity/19778 2020-12-11 07:38:16+00:00| seen| https://t.me/cibsecurity/19798 2020-12-11 08:25:33+00:00| seen| https://t.me/cibsecurity/19818 2020-12-11 09:25:28+00:00| seen| https://t.me/cibsecurity/198...

New Grelos Skimmer Variants Siphon Credit Card Data

Just as seasonal online shopping kicks into high gear, new variants of the point-of-sale Grelos skimmer malware have been identified. Variants are targeting the payment-card data of online retail shoppers on dozens of compromised websites, researchers warn. The Grelos skimmer malware has been...

AudimexEE Cross-Site Scripting Vulnerability

AudimexEE is an auditing software for large organizations. A cross-site scripting vulnerability exists in AudimexEE versions prior to 14.1.1, which allows remote attackers to perform web script or html injection via action, cargo, panel, leading to data leakage if the uniqueerrornumbers security...

CVE-2020-28047

AudimexEE before 14.1.1 is vulnerable to Reflected XSS Cross-Site-Scripting. If the recommended security configuration parameter "uniqueerrornumbers" is not set, remote attackers can inject arbitrary web script or HTML via 'action, cargo, panel' parameters that can lead to data leakage...

skia:sksl2spirv: Segv on unknown address in std::__1::unique_ptr<SkSL::Expression, std::__1::default_delete<SkSL::Expression

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=6198631948091392 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

unique-portal.de Cross Site Scripting vulnerability OBB-1460334

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

DEBIAN-CVE-2020-3864

A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin...

CVE-2015-0932

creationtimestamp| type| source ---|---|--- 2020-10-09 17:08:30+00:00| seen| MISP/6a1671d3-73c6-428b-9bae-305e59dcf452...

The Strangest Election Scenario Runs Through Georgia

There’s a small but real possibility that we won’t know which party controls the Senate until 2021, thanks to a special election and a unique state requirement...

webkitgtk: Non-unique security origin for DOM object contexts

A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin...

LIVE Webinar on Zerologon Vulnerability: Technical Analysis and Detection

I am sure that many of you have by now heard of a recently disclosed critical Windows server vulnerability—called Zerologon—that could let hackers completely take over enterprise networks. For those unaware, in brief, all supported versions of the Windows Server operating systems are vulnerable t...

CVE-2020-25772

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the...

CVE-2020-25770

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the...

Twitter Warns Developers of API Bug That Exposed App Keys, Tokens

Twitter developers are being warned of a security bug that may have exposed their applications’ credential information – including sensitive application keys and access tokens. The issue stemmed from a caching issue in developer.twitter.com. When developers visited this website, it temporarily...

Unsecured Microsoft Bing Server Exposed Users' Search Queries and Location

A back-end server associated with Microsoft Bing exposed sensitive data of the search engine's mobile application users, including search queries, device details, and GPS coordinates, among others. The logging database, however, doesn't include any personal details such as names or addresses. The...