#web

Categories: News Categories: Personal If you've received a message from a company saying your data has been caught up in a breach, you might be unsure what to do next. Well, we have some tips for you... (Read more...) The post Involved in a data breach? Here’s what you need to know appeared first on Malwarebytes Labs.

Categories: Personal Tags: cryptocurrency Tags: mark cuban Tags: scam Tags: phish Tags: phishing Tags: wallet Tags: hot Tags: cold Tags: metamask Tags: extension Tags: browser Tags: mobile Tags: android Tags: search engine We take a look at a common cryptocurrency scam which focuses on your recovery phrase. (Read more...) The post Steer clear of cryptocurrency recovery phrase scams appeared first on Malwarebytes Labs.

A SSRF vulnerability exists, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. the application is using a whitelist, but the whitelist can be bypassed with @ and encoded value of @ (%40) GET /proxy/?url=http://development.demo.geonode.org%40geoserver:8080/geoserver/web This will trick the application that the first host is a whitelisted address, but the browser will use @ or %40 as a credential to the host geoserver on port 8080, this will return the data to that host on the response. 

### Summary Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. ### Details The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. ### PoC To reproduce this vulnerability, please follow these steps: Start the Faktory Docker and limit memory usage to 512 megabytes for better demonstration: ``` $ docker run --rm -it -m 512m \ -p 127.0.0.1:7419:7419 \ -p 127.0.0.1:7420:7420 \ contribsys/faktory:latest ``` Send the following request. The Faktory server will exit after a few seconds due to out of memory: ``` $ curl 'http://localhost:7420/?days=922337' ``` ### Impact **Server Availability**: The vulnerability can crash the Faktory server, affecting its availability. **Denial of...

SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods.

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.

A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'selector' parameter in '/reset-password'.

Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.

A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'.