#chrome

Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency. "Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring  browsing history, taking screenshots,

Online Pizza Ordering version 1.0 suffers from a remote shell upload vulnerability.

ManageEngine Access Manager Plus version 4.3.0 suffers from a path traversal vulnerability.

Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.

By Waqas Mullvad VPN and the Tor Project Join Forces to Launch Mullvad Browser, a Privacy-Focused Web Browser. This is a post from HackRead.com Read the original post: Mullvad VPN and Tor Project Release Mullvad Browser

Categories: Apple Categories: News Tags: MacStealer Tags: mac infostealer Tags: information stealer Tags: Apple Tags: Thomas Reed Tags: iCloud Keychain MacStealer could be an infamous stealer in the making, but right now, it needs improvement, according to Malwarebytes expert. (Read more...) The post New macOS malware steals sensitive info, including a user's entire Keychain database appeared first on Malwarebytes Labs.

Categories: News Tags: twitter Tags: blue Tags: verified Tags: verification Tags: fake Tags: fraud Tags: phish Tags: phishing Tags: scam Tags: imposter Significant changes to Twitter's verification identifiers mean new rules for ensuring whether an account is real. (Read more...) The post Big changes to Twitter verification: How to spot a verified account appeared first on Malwarebytes Labs.

A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768.

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 24 and March 31. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key

Cacti version 1.2.22 suffers from a remote command execution vulnerability.