2731 matches found
CVE-2024-53556
An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the login page URL...
Fake Discount Sites Exploit Black Friday to Hijack Shopper Information
A new phishing campaign is targeting e-commerce shoppers in Europe and the United States with bogus pages that mimic legitimate brands with the goal of stealing their personal information ahead of the Black Friday shopping season. "The campaign leveraged the heightened online shopping activity in...
CVE-2024-52520
The CVE-2024-52520 entries describe a vulnerability in Nextcloud Server where a pre-flighted HEAD request allows the link reference provider to be tricked into downloading larger websites than intended to extract open-graph data. Affected software includes Nextcloud Server and Enterprise Server w...
The vulnerability of the Eclipse Glassfish application server relates to the redirection of URLs to an unreliable website, allowing attackers to redirect users to any given URL address.
The vulnerability of the Eclipse Glassfish application server is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a hacker to redirect users to any given URL address...
New GootLoader Campaign Targets Users Searching for Bengal Cat Laws in Australia
In an unusually specific campaign, users searching about the legality of Bengal Cats in Australia are being targeted with the GootLoader malware. "In this case, we found the GootLoader actors using search results for information about a particular cat and a particular geography being used to...
Open Redirect
github.com/coder/coder is vulnerable to Open Redirect. The vulnerability is due to lack of proper input validation on the Coder login page, allows attackers to manipulate the URL and redirect users to malicious websites...
Crooks bank on Microsoft’s search engine to phish customers
We identified a new wave of phishing for banking credentials that targets consumers via Microsoft's search engine. A Bing search query for 'Keybank login' currently returns malicious links on the first page, and sometimes as the top search result. We have reported the fraudulent sites to Microsof...
Loose-lipped neural networks and lazy scammers
One topic being actively researched in connection with the breakout of LLMs is capability uplift – when employees with limited experience or resources in some area become able to perform at a much higher level thanks to LLM technology. This is especially important in information security, where...
The vulnerability of the AWV component (Audio, Web, and Video Conferencing) of the Mitel MiCollab collaboration platform allows attackers to carry out phishing attacks.
The vulnerability of the AWV Audio, Web, and Video Conferencing component of the Mitel MiCollab collaboration platform involves redirecting URLs to an unreliable website. Exploiting this vulnerability allows attackers to carry out phishing attacks using a specially created link...
Security Bulletin: A Security Vulnerability was fixed in IBM Security Verify Access. (CVE-2024-35133)
Summary An issue found in the IBM Security Verify Access OIDC code could allow a remote attacker to cause a Redirect URL vulerability Vulnerability Details CVEID:CVE-2024-35133 DESCRIPTION: IBM Security Verify Access OIDC Provider could allow a remote attacker to conduct phishing attacks, using a...
Malicious code in websites-assets (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9915 Malicious code in websites-assets (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-46911 Apache Roller: Weakness in CSRF protection allows privilege escalation
Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...
5 Must-Have Tools for Effective Dynamic Malware Analysis
Dynamic malware analysis is a key part of any threat investigation. It involves executing a sample of a malicious program in the isolated environment of a malware sandbox to monitor its behavior and gather actionable indicators. Effective analysis must be fast, in-depth, and precise. These five...
U.S. Sanctions Two Crypto Exchanges for Facilitating Cybercrime and Money Laundering
The U.S. government on Thursday sanctioned two cryptocurrency exchanges and unsealed an indictment against a Russian national for his alleged involvement in the operation of several money laundering services that were offered to cybercriminals. The virtual currency exchanges, Cryptex and PM2BTC,...
PT-2024-29120
Name of the Vulnerable Software and Affected Versions Safari versions prior to 18 macOS versions prior to Sequoia 15 Description The issue was addressed with improved UI. Visiting a malicious website may lead to address bar spoofing. Recommendations For Safari versions prior to 18, update to Safa...
"@cosme" App fails to restrict custom URL schemes properly
Overview "@cosme" App provided by istyle Inc. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Pantuhong Sorasiri of LAC Co., Ltd. reported this...
iStyle @cosme 安全漏洞
iStyle @cosme is a comprehensive cosmetics and beauty website from iStyle Japan. A security vulnerability exists in iStyle @cosme that stems from improper authorization in the custom URL scheme issue handler, which allows an attacker to direct users to arbitrary websites via a vulnerable...
Lowe’s employees phished via Google ads
In mid-August, we identified a malvertising campaign targeting Lowes employees via Google ads. Like many large corporations, Lowes has their own employe portal called MyLowesLife, for all matters related to schedule, pay stubs, or benefits. Lowes employees who searched for "myloweslife" during th...
