Flatpress cross-site scripting vulnerabilities

FlatPress is a lightweight, easy to set up blogging engine. A cross-site scripting vulnerability exists in the "Blog Content" component of FlatPress 1.0.3. An attacker can exploit this vulnerability to steal cookies...

CVE-2020-35241: Improper Neutralization of Input During Web Page Generation

FlatPress 1.0.3 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie...

Fluxbb Cross-Site Scripting Vulnerability

FluxBB is an open source forum application. A cross-site scripting vulnerability exists in the "Blog Content" component of FluxBB 1.5.11. An attacker can exploit this vulnerability to steal cookies...

h1-ctf: Flags for hackyholidays CTF

Hi, Here are all the flags: 1. robots.txt: flag48104912-28b0-494a-9995-a203d1e261e7 2. s3cr3t-ar3a: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 3. people-rater: flagb705fb11-fb55-442f-847f-0931be82ed9a 4. swag-shop: flag972e7072-b1b6-4bf7-b825-a912d3fd38d6 5. secure-login:...

Russia's SolarWinds Hack Is a Historic Mess

All the most important stories about the biggest hack in years...

[IT 管理者向け] CVSS を読み解いて脆弱性をより正しく理解する

新しいバージョンのセキュリティ更新プログラムについては下記の関連ブログもご覧ください。 「新しいセキュ...

Happy HaXmas from the Rapid7 Team!

Happy HaXmas, everyone! This has been quite the year, but we’re thrilled that we’re able to keep up our favorite holiday tradition of our annual HaXmas blog series, which features holiday stories, hacking wins from the year, tips and tricks, and general festivity to keep you entertained during th...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking online at Western Washington University on January 20, 2021. Details to come. I’ll be speaking at an Informa event on February 28, 2021. Details to come. The list is maintained on this page...

Ornose15 Newpk SQL Injection Vulnerability

Ornose15 Newpk is a Php-based blog management platform from the individual developers at Ornose15. NewPK 1.1 version exists SQL injection vulnerability, the vulnerability stems from the title parameter adminnewpost.php does not do effective filtering of user input, attackers can use this...

Friday Squid Blogging: Newly Identified Ichthyosaur Species Probably Ate Squid

This is a deep-diving species that "fed on small prey items such as squid." Academic paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Exploit for Deserialization of Untrusted Data in Microsoft

weaponized tool for CVE-2020-17144Microsoft Exchange 2010 MR...

Building a Zero Trust business plan

These past six months have been a remarkable time of transformation for many IT organizations. With the forced shift to remote work, IT professionals have had to act quickly to ensure people continue working productively from home—in some cases bringing entire organizations online over a weekend...

Cybersecurity Firm FireEye Got Hacked; Red-Team Pentest Tools Stolen

FireEye, one of the largest cybersecurity firms in the world, said on Tuesday it became a victim of a state-sponsored attack by a "highly sophisticated threat actor" that stole its arsenal of Red Team penetration testing tools it uses to test the defenses of its customers. The company said it's...

This Company Uses AI to Outwit Malicious AI

Robust Intelligence is among a crop of companies that offer to protect clients from efforts at deception...

Mblog open source Java blog system has a logic flaw vulnerability

Mblog is a Java language development , support for mysql/h2 database , using spring-boot, jpa, shiro, bootstrap and other popular frameworks for the development of open source free blog system . Mblog open source Java blog system has a logic flaw vulnerability , an attacker can use the...

Trump’s Election Attack Ends December 14—Whether He Knows It or Not

Despite the Trump campaign’s fight to overturn the election, the wheels of American democracy keep turning...

Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF

Exploit Title: Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF Date: 2020-07-30 Author: Julien Ahrens Vendor Homepage: https://www.acronis.com Version: 12.5 Build 16341 CVE: CVE-2020-16171 VERSIONS AFFECTED ==================== Acronis Cyber Backup v12.5 Build 16327 and probably belo...

Automattic: Stored XSS in Intense Debate comment system

Hi Team, Summary: The Intense Debate comment system is vulnerable to stored xss by users , this would allow for atacking admins/users on the blog , Platforms Affected: Intense Debate comment system Steps To Reproduce: 1. Go to intensedebate.com/moderate/-ID- 2. Go to comments allow images in...

XSS Vulnerability in mblog Blog System

mblog is a Java language development , support for mysql/h2 database , using spring-boot, jpa, shiro, bootstrap and other popular frameworks for the development of open-source free blog system . mblog blog system has an XSS vulnerability , an attacker can exploit the vulnerability to obtain user...

Inrupt’s Solid Announcement

Earlier this year, I announced that I had joined Inrupt, the company commercializing Tim Berners-Lees Solid specification: The idea behind Solid is both simple and extraordinarily powerful. Your data lives in a pod that is controlled by you. Data generated by your things -- your computer, your...