Windows Defender Advanced Threat Protection の機械学習: 未知の侵入アクティビティの検出

本記事は、Windows Security のブログ “Windows Defender ATP machine learning: Detecting new and unusual breach activity” 2017 年 8 月 3 日 米...

Windows Defender Advanced Threat Protection で反射型の DLL 読み込みを検出

本記事は、Windows Security のブログ “Detecting reflective DLL loading with Windows Defender ATP” 2017 年 11 月 13 日 米国時間公開...

imprimerie-blog.com XSS vulnerability

Open Bug Bounty ID: OBB-458249 Description| Value ---|--- Affected Website:| imprimerie-blog.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Cambium cnPilot r200/r201 Login Scanner and Config Dump

This module scans for Cambium cnPilot r200/r201 management login portals, attempts to identify valid credentials, and dump device configuration. The device has at least two 2 users - admin and user. Due to an access control vulnerability, it is possible for 'user' account to access full device...

Cells Blog 3.5 - bgid fmid fnid SQL Injection

Cells Blog 3.5 - bgid fmid fnid SQL Injection Exploit Title: Cells Blog 3.5 - SQL Injection Dork: N/A Date: 16.12.2017 Vendor Homepage: http://www.cells.tw/ Software Link: http://www.cells.tw/cells/ Version: 3.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Senc...

Cells Blog 3.5 - 'bgid' / 'fmid' / 'fnid' SQL Injection

Exploit Title: Cells Blog 3.5 - SQL Injection Dork: N/A Date: 16.12.2017 Vendor Homepage: http://www.cells.tw/ Software Link: http://www.cells.tw/cells/ Version: 3.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Sencan Author Web: http://ihsan.net Author Social:...

blog.ticketmaster.nl XSS vulnerability

Open Bug Bounty ID: OBB-448092 Description| Value ---|--- Affected Website:| blog.ticketmaster.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Beware of PerformanceTiming.domInteractive

...

Beware of PerformanceTiming.domInteractive

...

blog.andertons.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-436194 Description| Value ---|--- Affected Website:| blog.andertons.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Serendipity blog component SQL injection vulnerability

Serendipity is a PHP-based blogging system. The system supports the creation of online diaries, blogs, web pages, etc. blog component is one of the blogging components. A SQL injection vulnerability exists in the blog component in Serendipity version 2.0.3. A remote attacker can exploit this...

OSX.Proton spreading through fake Symantec blog

Sunday night, a series of tweets from security researcher @noarfromspace revealed a new variant of the OSX.Proton malware, spreading in a concerning new method—spoofing security company Symantec's blog. Method of infection The malware is being promoted via a fake Symantec blog site at...

Windows Defender System Guard でシステムのセキュリティを強化し整合性を維持する

本記事は、Windows Security のブログ “Hardening the system and maintaining integrity with Windows Defender System Guard” 2017 年 10 月 23 日 米国...

Sql injection

Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure...

zorovavi/blog SQL Injection Vulnerability

zorovavi/blog is a blogging system. A SQL injection vulnerability exists in zorovavi/blog 2017-10-17 and earlier. A remote attacker can exploit the vulnerability by sending the 'id' parameter to the recept.php file to upload arbitrary files...

auxblogcms 1.0.6 Backend Login Bypass Vulnerability

auxblogcms is a php personal blog system based on PHP+MySQL program. auxblogcms 1.0.6 has a background bypass login vulnerability, which can be exploited by attackers to bypass background cookies and obtain sensitive information...

Dynamic News Magazine&Blog CMS SQL Injection Vulnerability

Dynamic News Magazine&Blog CMS is a content management system mainly used for information websites. A SQL injection vulnerability exists in Dynamic News Magazine&Blog CMS version 1.0. A remote attacker can inject SQL commands by sending the 'id' parameter to the admin/adminprocess.php file...

Heart Size: Yet Another Biometric

Turns out that heart size doesn't change throughout your adult life, and you can use low-level Doppler radar to scan the size -- even at a distance -- as a biometric. Research paper to be available soon...

blog.shortfusion.com XSS vulnerability

Vulnerable URL: http://blog.shortfusion.com/index.cfm/%22%27--!%3E%3C/Title/%3C/Style/%3C/Script/%3C/c/%3C/Noscript/%3C/Pre/%3C/Xmp%3E%3CBody/OnPageShow=confirm/WELCOME/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.12.2017 Vulnerability type:| XSS Vulnerability...

Like Button Rating < 2.5.4 - Unauthenticated Arbitrary Blog Settings Change

In the init action, this plugin checked to see if $POST'likebtnimportconfig' is empty. If it’s not empty then it base64-decodes the string, parses it as JSON, and starts changing options. This could allow attackers to change blog settings such as the Site Title. The below form will set the “Site...