Code Execution Vulnerability in Axublog Blogging System

axublog is a PHP personal blog system. A code execution vulnerability exists in the Axublog blog system. The vulnerability is caused due to the failure to validate the reloaded files, which can be exploited by an attacker to construct a specially crafted file, upload a shell, and gain...

Friday Squid Blogging: Squids from Space Video Game

An early preview. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

The grugq on Reality Winner, the Intercept, and OPSEC

Good commentary...

wanderingroot.com XSS vulnerability

Vulnerable URL: http://www.wanderingroot.com/blog/2015/9/3/sweet-potato-egg-scramble/...

Comments from retricted blog post visible for unrestricted user

h5. Summary All comments made before the post restriction changed to "Viewing and editing restricted" will be available to all user in all updates. This is only happening for blog post, and page restriction working as expected. Tested in version 5.9.1customer's version and 6.1.3, same behavious c...

Safety and Security and the Internet of Things

Ross Anderson blogged about his new paper on security and safety concerns about the Internet of Things. See also this short video. It's very much along the lines of what I've been writing...

Sensitive Information Leak

Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...

Cross-site Scripting (XSS)

Moodle is susceptible to cross-site scripting XSS attacks. The attacks are possible because the parameter passed to blog/index.php is not properly sanitized. It allows the attackers to inject arbitrary web script or HTML through it when Internet Explorer is used...

SEI Issues Advice on Ransomware

The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...

blog-food.ru XSS vulnerability

Vulnerable URL: https://blog-food.ru/search-results?query=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 10522...

Aries QWR-1104 Wireless-N Cross Site Scripting

Exploit Title: Aries QWR-1104 Wireless-N Router Execute JavaScript in Wireless Site Survey page. Date: 26-05-2017 Vendor Homepage : http://www.ariesnetworks.net/ Firmware Version: WRC.253.2.0913 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...

テクニカル サポート詐欺との戦い

本記事は、Microsoft Digital Crimes Unit の Courtney Gregoire による投稿 "The fight against tech support scams" 2017 年 5 月 18 日 米国時間公開 を翻訳したも...

Moodle 2.7.x < 2.7.20 Multiple Vulnerabilities

Binary data 700123.prm...

Moodle 3.2.x < 3.2.3 Multiple Vulnerabilities

Binary data 700126.prm...

Unauthorized Blog Search

Moodle is vulnerable to unauthorized blog searches. There is a missing capability check that allows users to search blogs without permission...

Arbitrary Blog Ownership

Moodle is vulnerable to arbitrary blog ownership. If an authenticated user edits a blog through an external blog link, the ownership changes to the current user...

Recent Python Meterpreter Improvements

The Python Meterpreter has received quite a few improvements this year. In order to generate consistent results, we now use the same technique to determine the Windows version in both the Windows and Python instances of Meterpreter. Additionally, the native system language is now populated in the...

CVE-2017-7489

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...

Code injection

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...

CVE-2017-7489

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...