A Trickbot Assault Shows US Military Hackers' Growing Reach

Despite the operation's short-term effects, it sets new precedents for the scope of Cyber Command's mission...

MonoCMS Blog Information Disclosure Vulnerability

Mono is a free and open source project hosted by Xamarin previously Novell, first Ximian. A security vulnerability exists in version 1.0 of MonoCMS Blog, which stems from storing a hard-coded administrative hash in the log.xml file in the source file of MonoCMS Blog, with hash type bcrypt and has...

CVE-2020-25985

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver php files can be unlinked and not deleted...

CVE-2020-25985

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver php files can be unlinked and not deleted...

CVE-2020-25985

CVE-2020-25985 affects MonoCMS Blog 1.0. The vulnerability is described as Arbitrary File Deletion: any authenticated user can delete files on and off the webserver, with PHP files potentially unlinked rather than deleted. The connected documents confirm this as the concrete issue, but do not pro...

CVE-2020-25985

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver php files can be unlinked and not deleted...

New Privacy Features in iOS 14

A good rundown...

CVE-2020-25986

A Cross Site Request Forgery CSRF vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user...

CVE-2020-25986

A Cross Site Request Forgery CSRF vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user...

CVE-2020-25987

MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash...

CVE-2020-25987

MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash...

Cross site request forgery (csrf)

A Cross Site Request Forgery CSRF vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user...

Hardcoded credentials

MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash...

CVE-2020-25986

CVE-2020-25986 (MonoCMS Blog 1.0) is a CSRF vulnerability that, per the description, allows an attacker to change a user’s password. The core affected component is MonoCMS Blog 1.0; the root cause is CSRF that enables unwanted state-changing requests without user interaction, leading to credentia...

CVE-2020-25986

A Cross Site Request Forgery CSRF vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user...

CVE-2020-25987

MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash...

CVE-2020-25987

CVE-2020-25987 affects MonoCMS Blog 1.0. The issue arises from hard-coded admin hashes stored in log.xml within the MonoCMS Blog source, with the hash type bcrypt and hashcat mode 3200 cited as crackable. This can enable credential exposure or misuse if an attacker can access the log.xml contents...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 86 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 86.0.4240.75 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

Elastic: Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)

Summary: deparam function which parses location.hash in https://s.swiftypecdn.com/install/v2/st.js is vulnerable to prototype pollution. There is a script gadget in the same js file which leads to XSS. Steps To Reproduce: Visit Refresh if you don't see a pop up...

Meet JWT heartbreaker, a Burp extension that finds thousands weak secrets automatically

In the recent post https://wlrm210771357.wpcomstaging.com/340-weak-jwt-secrets-you-should-check-in-your-code/, we presented a wallarm/jwt-secrets GitHub repository with a 340 JSON Web Token secrets available publicly. Using this data, its possible to check if you or your developers forgot to chan...