Is ‘REvil’ the New GandCrab Ransomware?

The cybercriminals behind the GandCrab ransomware-as-a-service RaaS offering recently announced they were closing up shop and retiring after having allegedly earned more than $2 billion in extortion payments from victims. But a growing body of evidence suggests the GandCrab team have instead...

WordPress Affiliates Manager plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Affiliates Manager plugin versions = 2.6.5. Solution Update the WordPress Affiliates Manager plugin to the latest available version at least 2.6.6...

Affiliates Manager < 2.6.6 - CRSF Issues

Multiple actions were lacking CSRF checks, and could allow attackers to change the plugin's settings via CSRF attacks...

Chaturbate: Missing CSRF Protection in /stats EndPoint.

EndPoint /affiliates/stats. doesnot verify the CSRF Tokens Steps To Reproduce: 1. Login with the your account 2. Navigate to the URL https://chaturbate.com/affiliates/stats.. 3. Check the stats in default its todays date or this week in select period. 4. Intercept the request and change the...

idanceacademy.com XSS vulnerability

Open Bug Bounty ID: OBB-617938 Description| Value ---|--- Affected Website:| idanceacademy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pickaweb.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-498106 Description| Value ---|--- Affected Website:| pickaweb.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure base...

kadolijst.nl Open Redirect vulnerability

Open Bug Bounty ID: OBB-487399 Description| Value ---|--- Affected Website:| kadolijst.nl Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on ISO 291...

overfarm.digitickets.co.uk Open Redirect vulnerability

Open Bug Bounty ID: OBB-407716 Description| Value ---|--- Affected Website:| overfarm.digitickets.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat...

plymrail.digitickets.co.uk Open Redirect vulnerability

Vulnerable URL: https://plymrail.digitickets.co.uk/affiliates/?aid=52025B4D=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

frostsgroup.digitickets.co.uk Open Redirect vulnerability

Open Bug Bounty ID: OBB-407700 Description| Value ---|--- Affected Website:| frostsgroup.digitickets.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Chea...

shropshirekidsfest.digitickets.co.uk Open Redirect vulnerability

Vulnerable URL: https://shropshirekidsfest.digitickets.co.uk/affiliates/?aid=53F1CFE4=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status...

thedanny.digitickets.co.uk Open Redirect vulnerability

Open Bug Bounty ID: OBB-407686 Description| Value ---|--- Affected Website:| thedanny.digitickets.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat...

linkconnector.com XSS vulnerability

Vulnerable URL: https://www.linkconnector.com/affiliates/affiliate-application/?cid=x%22%3E%3CsvG%20onLoad=prompt9%3E=149989 Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 15.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

goldcrownresort.com XSS vulnerability

Vulnerable URL: http://www.goldcrownresort.com/affiliates/affiliatelogin.php?affiliateid=2065name=/%22%3E%3Cimg%20src=x%20onerror=alert%27OPENBUGBOUNTY%27%3ECerritos+Resort Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.01.2018 Vulnerability type:| XSS Vulnerability...

CVE-2017-14622

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...

WordPress 2kb Amazon Affiliates Store Plugin Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a set of blogging platform developed in PHP language by WordPress Software Foundation, which supports setting up personal blog sites on servers with PHP and MySQL.2kb Amazon Affiliates Store plugin is one of the Amazon Store plugins. Multiple cross-site scripting vulnerabilities exis...

2kb Amazon Affiliates Store <= 2.1.0 - Authenticated Cross-Site Scripting (XSS)

Description The 2kb Amazon Affiliates Store WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress 2kb Amazon Affiliates Store plugin <=2.1.0 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Ricardo in WordPress 2kb Amazon Affiliates Store plugin versions =2.1.0. Solution Update the WordPress 2kb Amazon Affiliates Store plugin to the latest available version at least 2.1.1...

CVE-2017-14622

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...