Neoscreen 4.5 Cross Site Scripting

Exploit Title: Neoscreen Cross-site scripting Product: Neoscreen by Cube Digital Media Vulnerable Versions: 4.5 and all previous versions Tested Version: 4.5 Advisory Publication: July 24, 2016 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: NONE Credit: Alex Haynes Advisory Detail...

Facebook Messenger adds End-to-End Encryption (Optional) for Secret Conversations

Facebook has begun rolling out end-to-end encryption for its Messenger app, thus making its users' conversations completely private. The end-to-end encryption feature, dubbed "Secret Conversations," will allow Messenger users to send and receive messages in a way that no one, including the FBI wi...

g2mi.com XSS vulnerability

Vulnerable URL: http://www.g2mi.com/companydescription.php?id=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 10:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CWE-89 CVE Reference: NONE...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Exploit for php platform in category web applications Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL...

Notilus 2012 R3 SQL Injection

Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CWE-89 CVE Reference: NONE...

Vulnerability in OpenSSL - Divide-and-conquer session key recovery in SSLv2

This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. s2srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace...

results.mu.ac.in XSS vulnerability

Vulnerable URL: http://results.mu.ac.in/choosenoc.php?examid=3691year=%27%22%3E%20111%3Cimg%20src=1%20onerror=confirm/xssposed/%3Emonth=APR Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

numerology369.com XSS vulnerability

Vulnerable URL: http://numerology369.com/numerologychart.php?firstname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5668785 Google...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

Yahoo Transparency Report Shows Requests for Data Up

Yahoo this week published its transparency report for the first six months of the year and the numbers indicate that government requests for data on its users are up slightly after sharp dropoff for the report covering the last six months of 2014. Yahoo said that it received 5,221 government data...

Qlikview 11.20 SR11 - Blind XML External Entity Injection

Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Improper Restriction of XML External Entity Reference CWE-611...

Qlikview 11.20 SR11 - Blind XXE Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Imprope...

milb.com XSS vulnerability

Vulnerable URL: http://www.milb.com/search/?start=1"===milb" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4075 Google Pagerank| 6 VIP website status:| Yes Check milb.com SSL...

alex-shop.su XSS vulnerability

Vulnerable URL: http://alex-shop.su/search?a=0=%3Cscript%3Ealert%28%2FXSSPOSED%2F%29%3B%3C%2Fscript%3E=%3Cscript%3Ealert%28%2FXSSPOSED%2F%29%3B%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 21:14 GMT Vulnerability type:| XSS...

espnfc.us XSS vulnerability

Vulnerable URL: http://www.espnfc.us/concacaf-gold-cup/59/blog/post/2515671/us-lucky-vs-honduras-clint-dempsey-brad-guzan-save-win"v0raz Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Facebook Hires Ex-Yahoo CISO Alex Stamos

Facebook has hired away the top security executive at Yahoo, Alex Stamos, to become the company’s new CSO. Stamos said Wednesday that he is joining Facebook because he believes the company is in the best position to address some of the large security challenges facing users and companies right no...

Creator of Blackshades Malware Jailed 4 Years in New York

A Swedish man who was the mastermind behind the $40 BlackShades Remote Access Tool RAT that infected over half a million systems around the world was sentenced to almost five years in a U.S. prison on Tuesday. Alex Yücel, 25, owned and operated an organization called "BlackShades" that sold a...

[CVE-2015-4107] Wing FTP Server Remote Code Execution vulnerability

Exploit Title: Wing FTP Server Remote Code Execution vulnerability Product: Wing FTP Server Vulnerable Versions: 4.4.6 and all previous versions Tested Version: 4.4.6 Advisory Publication: 05/06/2015 Latest Update: 05/06/2015 Vulnerability Type: Improper Control of Generation of Code CWE-94 CVE...

Wing FTP 4.4.6 Cross Site Request Forgery

Exploit Title: Wing FTP Server Cross-site Request Forgery vulnerabilities Product: Wing FTP Server Vulnerable Versions: 4.4.6 and all previous versions Tested Version: 4.4.6 Advisory Publication: 05/06/2015 Latest Update: 05/06/2015 Vulnerability Type: Cross-site Request Forgery CWE-352 CVE...