E-mail Address Disclosure

Email addresses are typically found on "Contact us" pages, however, they can also be found within scripts or code comments of the application. They are used to provide a legitimate means of contacting an organisation. As one of the initial steps in information gathering, cyber-criminals will spid...

Deploying enterprise MDX enabled apps from App Store via Volume Purchase

The CEM/XenMobile Server is currently optimized for Volume Purchase distribution of Public App Store apps that are not MDX enabled. While it is possible to distribute MDX enabled apps from App Store via volume purchase, some considerations must be taken into account for optimal performance. This...

Bonza Digital Cart Script 1 SQL Injection

Title: Bonza Digital Cart Script v1 - SQL injection Credit: Bilal KARDADOU Vendor: http://www.turnkeycentral.com Vendor URL: http://www.turnkeycentral.com/scripts/bonza-digital-cart-script/ Product: Bonza Digital Cart Script v1 Google Dork: N/A Product & Service Introduction: "Bonza Digital Cart"...

Protecting Your Web Apps with AppSpider Defend Until They Can Be Patched

AppSpider scans can detect exploitable vulnerabilities in your applications, but once these vulnerabilities are detected how long does it take your development teams to create code fixes for them? In some cases it could take several days to weeks before a fix/patch to resolve the vulnerability ca...

Ubuntu 12.04 LTS : icoutils vulnerabilities (USN-3226-1)

Jerzy Kramarz discovered that icoutils incorrectly handled memory when processing certain files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause icoutils to crash, resulting in a denial of service, or possibly execute arbitrary code. Note...

Automated Job Portal Script - SQL Injection

Exploit Title: Automated Job Portal Script - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://www.jagaad.com/ Software Buy: https://codecanyon.net/item/automated-job-portal-script/14318664 Demo: http://www.jagaad.com/demo/php/automated-job-portal/ Version: N/A Tested on: Wi...

ALPINE-CVE-2017-5484

The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sigprint...

FiercePhish - A Full-Fledged Phishing Framework To Manage All Phishing Engagements

FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. The features will continue to be expanded and will include website spoofing, click tracking, and extensive notificati...

Joomla 3.6.5 Remote code execution Exploit 0day

Joomla 3.6.5 Core suffers from a remote code execution vulnerability. Joomla Core affected Joomla! 3.6.X versions. Exploit automated. It is possible to specify a list of sites. For the work you need to install Python. This is private exploit. You can buy it at https://0day.today...

libass: Attempting free in ass_drawing_free

Project: https://github.com/libass/libass.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6332129302544384 Project: libass Fuzzer: libFuzzerlibassfuzzer Fuzz target binary: libassfuzzer Job Type: libfuzzerasanlibass Platform Id: linux Crash Type: Attempting free Crash...

Buggy Domain Validation Forces GoDaddy to Revoke Certs

GoDaddy has revoked, and begun the process of re-issuing, new SSL certificates for more than 6,000 customers after a bug was discovered in the registrar’s domain validation process. The bug was introduced July 29 and impacted fewer than two percent of the certificates GoDaddy issued from that dat...

AutoLocalPrivilegeEscalation - An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically

An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to find out the correct exploit, al...

Commix 1.6 - Automated All-In-One OS Command Injection And Exploitation Tool

Commix short for comm and i njection e x ploiter is an automated tool written by Anastasios Stasinopoulos @ancst that can be used from web developers, penetration testers or even security researchers in order to test web-based applications with the view to find bugs, errors or vulnerabilities...

Continuous Integration - Jenkins at your service

How Continuous Integration works Continuous integration is the process of - as the name suggests - continually merging all parts of code changed by developers. The main purpose of CI is to achieve better productivity and code integrity by using a shared code repository which is automatically buil...

PwC ACE-ABAP Remote Code Execution Vulnerability

ACE Automated Controls Evaluator is a tool developed by PwC PricewaterhouseCoopers that can be used to analyze SAP security settings to discern privileged access and potential segregation of duties.ABAP Advanced Business Application Programming. A remote code execution vulnerability exists in PwC...

pulledpork - Pulled Pork for Snort and Suricata Rule Management

PulledPork for Snort and Suricata rule management from Google code Features and Capabilities Automated downloading, parsing, state modification and rule modification for all of your snort rulesets. Checksum verification for all major rule downloads Automatic generation of updated sid-msg.map file...

[SECURITY] Fedora 25 Update: docker-1.12.3-6.git9a594b9.fc25

Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. Docker containers can encapsulate any payload, and will run consistently on and between virtually any server. The same container...

Acunetix v11 - Web Application Security Testing Tool

London, UK – November 2016 – Acunetix, the pioneer in automated web application security software, has announced the release of version 11. New integrated vulnerability management features extend the enterprise’s ability to comprehensively manage, prioritise and control vulnerability threats –...

IBM Resilient Cross-Site Scripting Vulnerability

IBM acquired Resilient Systems in order to enhance its security business and provide an automated response playbook to attacks. resilient's platform will be combined with IBM's QRadar Intelligence Platform and will be integrated with the Blue Giant's security portfolio. IBM Resilient suffers from...

Whitewidow 1.5.0 - SQL Vulnerability Scanner

Whitewidow is an open source automated SQL vulnerability scanner, that is capable of running through a file list, or can scrape Google for potential vulnerable websites. It allows automatic file formatting, random user agents, IP addresses, server information, multiple SQL injection syntax, and a...