9398 matches found
Halo cross-site scripting vulnerabilities
Halo is a modern blog/CMS system. A cross-site scripting vulnerability exists in Halo version 1.1.3. A remote attacker can exploit this vulnerability to execute arbitrary code via the blog publishing component...
Apple Censorship and Surveillance in China
Good investigative reporting on how Apple is participating in and assisting with Chinese censorship and surveillance...
emlog cross-site scripting vulnerability
emlog is a PHP and MySQL based blog and CMS builder. A cross-site scripting vulnerability exists in emlog version 6.0.0. The vulnerability can be exploited to execute arbitrary code by adding a specially crafted script as a link to a new blog post...
CVE-2020-18194
Cross Site Scripting XSS in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post...
PT-2021-10153
Name of the Vulnerable Software and Affected Versions: emlog version 6.0.0 Description: The issue allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post, which is a form of Cross Site Scripting XSS. This enables attackers to potentially inject...
Emlog cross-site scripting vulnerabilities
emlog is a PHP and MySQL based blog and CMS builder. A cross-site scripting vulnerability exists in emlog version 6.0.0. The vulnerability can be exploited to execute arbitrary code by adding a specially crafted script as a link to a new blog post...
WhatsApp’s New Privacy Policy Just Kicked In
Instead of a hard cutoff, the messaging app will gradually degrade and eventually cease to function if you don’t accept the changes...
Friday Squid Blogging: Far Side Squid Comic
A classic. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
Shining a Light on DARKSIDE Ransomware Operations
Update May 14: Mandiant has observed multiple actors cite a May 13 announcement that appeared to be shared with DARKSIDE RaaS affiliates by the operators of the service. This announcement stated that they lost access to their infrastructure, including their blog, payment, and CDN servers, and wou...
Kk Star Ratings Cross-Site Scripting Vulnerabilities
kk-star-ratings is an application. Used to allow blog visitors to engage and interact with your site by rating posts. A cross-site scripting vulnerability exists in the Kk Star Ratings plugin prior to version 4.1.5...
Catfish Blog V3.9.0 File Upload Vulnerability in Backend
Catfish Blog is an open source free PHP blog. A file upload vulnerability exists in the backend of Catfish Blog V3.9.0, which can be exploited by an attacker to gain control of the server...
File upload vulnerability in Catfish Blog V3.9.0 backend (CNVD-2021-37306)
Catfish Blog is an open source free PHP blog. A file upload vulnerability exists in the backend of Catfish Blog V3.9.0, which can be exploited by an attacker to gain control of the server...
Evernote: Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusion
Summary: The following endpoint was found to be vulnerable to SSRF : https://www.evernote.com/ro/aHR0cDovLzE2OS4yNTQuMTY5LjI1NC8jdGVzdC5qcw==/-1430533899.js The endpoint take a path in url and retrieve its content. it is supposed to be use on path but it can be used on URL to get access to intern...
Business email compromise campaign targets wide range of orgs with gift card scam
Cybercriminals continue to target businesses to trick recipients into approving payments, transferring funds, or, in this case, purchasing gift cards. This kind of email attack is called business email compromise BEC—a damaging form of phishing designed to gain access to critical business...
Logic flaw vulnerability in the backend of the mayday blog system
mayday blog system is based on springboot, mybatis, ehcache, thymeleaf, bootstrap to do the blog system , support markdown editor Java blog system . mayday blog system backend there is a logic flaw vulnerability. Attackers can use the vulnerability to bypass authentication and obtain sensitive...
Logic Flaw Vulnerability in SpringBoot-Blog
SpringBoot-Blog is a Java blog system . A logic flaw vulnerability exists in SpringBoot-Blog. An attacker can exploit the vulnerability to bypass authentication and obtain sensitive information...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed (CVE-2016-3092)
Summary IBM WebSphere Application Server is shipped with IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security...
Friday Squid Blogging: Squid-Shaped Bike Rack
Theres a new squid-shaped bike rack in Ballard, WA. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
We’re Hiring!
Were growing and we need to fill these 5 UK based roles: PHP Full-Stack Developer Pen Testing Consultant Red Team Support Digital Forensic Analyst IT Support Technician You can find all the details here. We think were a good bunch and there are some really good perks. If you have the skills and...