3467 matches found
CVE-2022-25813
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...
PT-2022-17538 · Apache · Apache Ofbiz
Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions 18.12.05 and earlier Description: The issue allows an attacker, acting as an anonymous user of the ecommerce plugin, to insert malicious content in the "Subject" field of a message from the "Contact us" page. This can le...
CVE-2022-25813: Improper Neutralization of Special Elements Used in a Template Engine
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...
Apache OFBiz Code Injection Vulnerability (CNVD-2023-03919)
Apache OFBiz is an enterprise resource planning ERP system from the Apache Foundation. A code injection vulnerability exists in Apache OFBiz versions 18.12.05 and earlier, which could be exploited to insert malicious content into the "Subject" field of the "Contact us" page. field of the "Contact...
The US May Soon Learn What a ‘Kid-Friendly’ Internet Looks Like
The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children...
U.S. Dept Of Defense: IDOR when editing email leads to Mass Full ATOs (Account Takeovers) without user interaction on https://██████/
Dear DoD team, I found one critical bug on your domain: https://██████/ It's IDOR. Also this domain is from Hack US program. What is that IDOR? Insecure direct object references IDOR are a type of access control vulnerability that arises when an application uses user-supplied input to access...
A US Propaganda Operation Hit Russia and China With Memes
Plus: An Iranian hacking tool steals inboxes, LastPass gets hacked, and a deepfake scammer targets the crypto world...
Incident Reporting Regulations Summary and Chart
A growing number of regulations require organizations to report significant cybersecurity incidents. We've created a chart that summarizes 11 proposed and current cyber incident reporting regulations and breaks down their common elements, such as who must report, what cyber incidents must be...
Healthcare industry tore down by Karakurt ransomware group
Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary The Karakurt ransomware group is a recent addition to the list of cybercriminal gangs, with reports of its first appearance in late 2021. Since June 2022, the recent attacks have had an impact on the US...
The Privacy Flaw Threatening US Democracy
Without robust federal protections, the country's widespread mass surveillance systems could be used against citizens like never before...
PT-2022-11574
Name of the Vulnerable Software and Affected Versions TP-Link Archer A7 version Archer A7US V5 210519 Description The issue is caused by a command injection vulnerability in the /usr/bin/tddp program, which takes part of the received data packet as part of the command. This allows an attacker to...
Google Android Elevation of Privilege Vulnerability (CNVD-2022-85762)
Google Android is a Linux-based open-source operating system from the US company Google. Google Android has an elevation of privilege vulnerability that can be exploited by attackers to elevate privileges...
Disrupting SEABORGIUM’s ongoing phishing operations
The Microsoft Threat Intelligence Center MSTIC has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state...
The US Offers a $10M Bounty for Intel on Conti Ransomware Gang
The State Department organization has called for people to share details about five key members of the hacking group...
What we know about VMWare CVE-2022–31656 and CVE-2022–31659
Takeaways: VMWare Workspace ONE vulnerabilities CVE-2022-31656 and CVE-2022-31659 work in tandem to allow a remote attacker with network access to conduct remote code execution on the server. Imperva Threat Research has seen a sharp rise in attacks since a POC was published on August 9, mostly...
US Blacklists Tornado Cash, GitHub Removes Co-Founder in Response
By Deeba Ahmed The US Treasury Department has blacklisted Tornado Cash on the accusation that the platform helped bad actors harvest… This is a post from HackRead.com Read the original post: US Blacklists Tornado Cash, GitHub Removes Co-Founder in Response...
The US Emergency Alert System Has Dangerous Flaws
Plus: A crypto-heist extravaganza, a peek at an NSO spyware dashboard, and more...
Wedding Hall Booking System 跨站脚本漏洞
Wedding Hall Booking System is a simple PHP-titled wedding hall booking system by the individual developer Carlo Montero. Wedding Hall Booking System suffers from a cross-site scripting vulnerability that stems from the manipulation of the parameter Message by an unknown function in the Contect...
Hackers Can Exploit US Emergency Alert System Flaws to Fake Warnings
By Deeba Ahmed These alerts include emergency warnings that are displayed or announced by interrupting the TV and radio broadcasts. The… This is a post from HackRead.com Read the original post: Hackers Can Exploit US Emergency Alert System Flaws to Fake Warnings...