musikhaus-wall.de Cross Site Scripting vulnerability OBB-3265524

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Bypassing a Theft Threat Model

Thieves cut through the wall of a coffee shop to get to an Apple store, bypassing the alarms in the process. I wrote about this kind of thing in 2000, in Secrets and Lies page 318: My favorite example is a band of California art thieves that would break into peoples houses by cutting a hole in...

CVE-2023-25017

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

CVE-2023-25018

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

Authorization

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

CVE-2023-25018 Rifartek IOT Wall - Reflected XSS

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

CVE-2023-25017 Rifartek IOT Wall - Broken Access Control

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

RIFARTEK IOT Wall 跨站脚本漏洞

Rifartek IOT Wall is a security software from the Chinese company Rifartek. A cross-site scripting vulnerability exists in RIFARTEK IOT Wall v.22, which is caused by insufficient filtering of user input in the transport function. The vulnerability can be exploited to inject JavaScript to perform ...

CVE-2023-25017

CVE-2023-25017 affects RIFARTEK IOT Wall (reported variants reference v.22 in CNNVD). The vulnerability is described as incorrect authorization allowing an authenticated remote user with general privileges to perform specific privileged functions and access/modify all sensitive data. The connecte...

CVE-2023-25018 Rifartek IOT Wall - Reflected XSS

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

CVE-2023-25018

The CVE-2023-25018 issue affects the RIFARTEK IOT Wall transportation function, where insufficient input filtering enables a reflected XSS vulnerability. An authenticated remote attacker with general user privileges can inject JavaScript via manipulated input to cause a reflected XSS. The availab...

CVE-2023-25017 Rifartek IOT Wall - Broken Access Control

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

KrebsOnSecurity in Upcoming Hulu Series on Ashley Madison Breach

KrebsOnSecurity will likely have a decent amount of screen time in an upcoming Hulu documentary series about the 2015 megabreach at marital infidelity site Ashley Madison. While I cant predict what the producers will do with the video interviews we shot, its fair to say the series will explore...

Malicious code in wall-e.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7317689c13174693567501f3ef7699b95a22d64ca1c24ee435cea015afcd38a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-959 Malicious code in wall-e.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7317689c13174693567501f3ef7699b95a22d64ca1c24ee435cea015afcd38a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview wall-e.api is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

France Fines Microsoft €60 Million for Using Advertising Cookies Without User Consent

France's privacy watchdog has imposed a €60 million $63.88 million fine against Microsoft's Ireland subsidiary for dropping advertising cookies in users' computers without their explicit consent in violation of data protection laws in the European Union. The Commission nationale de l'informatique...

CVE-2022-3789

A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument postid leads to sql injection. The exploit has been disclosed to the public and may be used...

Sql injection

A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument postid leads to sql injection. The exploit has been disclosed to the public and may be used...

CVE-2022-3789

Tim Campus Confession Wall contains a SQL injection vulnerability in the share.php functionality, triggered by manipulating the post_id argument. Multiple sources confirm the vulnerability, with public exploit disclosure. Affected component is an unknown functionality within share.php; no vendor/...