Phabricator: link reset problem

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Gratipay: Reset Link Issue

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Windows A high-risk vulnerability allows a hacker in the user access to phishing pages to steal their Microsoft account and related services-vulnerability warning-the black bar safety net

! In all Windows System are the presence of a security may cause the user to visit a phishing site case leaked their Microsoft account user name, password, and Microsoft account binding and is associated with a large number of important business, this information will also be affected Including:...

OLX: CSRF in account configuration leads to complete account compromise

Hello, Although listed as out of scope, this vulnerability presents serious risk that can compromise any account, and hope you consider it as such. When updating a user in the configuration tab, there is no CSRF token to prevent other pages from updating the user. This allows any third party site...

51 Million iMesh Accounts Available on Black Market

LeakedSource, an aggregator of data stolen in breaches, is advertising the availability of the account information of 51 million users of the now defunct iMesh peer-to-peer file-sharing music service. According to LeakedSource, the data is from a 2013 breach and includes email addresses, username...

用友账户体系控制不严导致大量内部敏感数据泄露（涉及总裁个人资料/可深入）

简要描述： 泄露公司大量敏感数据 故评高 详细说明： 一日闲逛 发现一个用友的信息泄露地址： https://github.com/tianjlj/TJL/blob/b2019f75eae34ee4ed3512974b9a9a8b3cd1087f/Ltest/sendmail.py 轻松拿到某个内部员工的账号密码 成功登录企业内部邮箱 密码信息 利用一号多用 成功登录用友云盘系统 大量公司敏感数据 例如92页的员工手册...

Who Viewed Your Profile on Instagram? Obviously, Hackers!

Are you curious about who viewed your profile on Instagram? This is probably the most frequently asked question nowadays, and there are several applications available on Google Play Store and Apple App Store, which claims to offer you the opportunity to see who is looking at your Instagram profil...

InVision: CRITICAL ██████

STEPS TO REPRODUCE: 1. █████ 2. ███████ alertdocument.domain. 3. ███ █████ IMPACT - Using this vulnerability an attacker can steal cookies and authenticate as the victim and may compromise the user account...

88 Percent of Networks Susceptible to Privileged Account Hacks

IT professionals have long grappled with the inherent risks associated with privileged accounts. Whenever credentials that allow other employees to login to servers, routers, and so forth, are compromised, it can have a dire outcome on the rest of the network. A security firm this week is warning...

ownCloud: owncloud.com: Account Compromise Through CSRF

@architaa, @vishnudfx, @konkakarthik and @hussain reported a CSRF vulnerability on the owncloud.com web page that may lead to an account take over. This issue has been mitigated meanwhile. To protect private information such as the reporters' email address this issue has been disclosed limitedly...

Google Patches Clickjacking Bug in API Explorer

Google has patched a clickjacking vulnerability that a researcher says would enable an attacker to retrieve or delete email conversations, manipulate YouTube and Google Plus accounts, and more. A Google representative said in an email to Threatpost that the bug affected developers who had...

WordPress 4.2 - Stored XSS Vulnerability

Exploit for php platform in category web applications Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If triggered by a logged-in administrator, unde...

PicketLink: SP does not take Audience condition of a SAML assertion into account

A flaw was found in the way PicketLink's Service Provider and Identity Provider handled certain requests. A remote attacker could use this flaw to log to a victim's account via PicketLink...

MallMold 2.5 app/action/newsletterAction.php SQL注入漏洞

/app/action/newsletterAction.phppublic function statistics //create a image header'Content-type:image/gif'; echo base64decode'R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=='; $sn = trim$GET'sn'; $email = trim$GET'ue'; $this-model'newsletter'-statistics$sn, $email;...

Dropbox: Unvalidated Redirects and Stored XSS

Hi, This bug might interest you. In the process of testing , I uploaded a file which contained the scripts: window.opener.location.replace'http://blackhorse.x10host.com/test.php'; alertdocument.domain alertdocument.cookie On opening of the uploaded file through the events section, the XSS pop-ups...

WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities

According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery...

WS-2014-0050

In “Cloudera/Hue”, versions v2.2.0 to v3.7.1 and cdh5-base-2.3.0 to cdh5-base-3.7.0 are vulnerable against Weak Password Requirements vulnerability which could allow an attacker to compromise a user account...

Malicious Kindle Ebook Let Hackers Take Over Your Amazon Account

If you came across a Kindle e-book download link from any suspicious sources or somewhere other than Amazon itself, check twice before you proceed download. As downloading an eBook could put your personal information at risk. A security researcher has uncovered a security hole in Amazon's Kindle...

HackerOne: Redirect while opening links in new tabs

Hello HackerOne, I'd like to report to you a nice little bug about opening links in new tabs. When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. POC:...

Threat Outbreak Alert RuleID10810: Email Messages Distributing Malicious Software on August 6, 2014

Medium Alert ID: 35056 First Published: 2014 July 28 13:10 GMT Last Updated: 2014 August 8 12:54 GMT Version: 4 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID10810 and...