CVE-2018-16628

panel/login in Kirby v2.5.12 allows XSS via a blog name...

CVE-2018-16628

panel/login in Kirby v2.5.12 allows XSS via a blog name...

CVE-2018-16628: Improper Neutralization of Input During Web Page Generation

panel/login in Kirby v2.5.12 allows XSS via a blog name...

PT-2018-13654

Name of the Vulnerable Software and Affected Versions Kirby version 2.5.12 Description The issue allows for XSS via a blog name in the panel/login endpoint. Recommendations For version 2.5.12, update to a newer version that contains a fix for this issue...

Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Fleetco Fleet Maintenance Management 1.2 - Remote Code Execution Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.fleetco.space Software Link:...

Security Bulletin: Code execution vulnerability with OpenID connect in WebSphere Application Server Liberty affects IBM WebSphere Application Server in IBM Cloud (CVE-2018-1851)

Summary There is a potential code execution vulnerability in OpenID connect in WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2018-1851 DESCRIPTION: IBM WebSphere Application Server OpenID Connect could allow a remote attacker to execute arbitrary code on the system, cause...

Cross site scripting

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

WPScan v3.4.0 - Black Box WordPress Vulnerability Scanner

WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites. INSTALL Prerequisites: Ruby = 2.2.2 - Recommended: 2.3.3 Curl = 7.21 - Recommended: latest - FYI the 7.29 has a segfault...

Friday Squid Blogging: Good Squid Fishing in the Exmouth Gulf

The conditions are ideal for squid fishing in the Exmouth Gulf in West Australia. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Turn Off Siri on Your Lock Screen for Better iOS Security

Every new version of iOS seems to bring with it a fresh lock screen bypass. Head the next one off by shushing Siri on your lock screen...

OLX: blog.praca.olx.pl database credentials exposure

Hi, I found that the site blog.praca.olx.pl is exposing the content of wp-config.php file in plaintext due that a misconfiguration in the file-manager plugin. The information can be accessed here: http://blog.praca.olx.pl/wp-content/uploads/file-manager/log.txt The credentials are stored in the...

phpBB 3.2.3: Phar Deserialization to RCE

Impact phpBB is one of the oldest and most popular board software. If an attacker aims to take over a board running phpBB3, he will usually attempt to gain access to the admin control panel by means of bruteforcing, phishing or XSS vulnerabilities in plugins that the target site has installed. Bu...

HackerOne: Verbose PHP error messages exposed on a blog article

Hey guys! For what its worth, warning messages aren't suppressed on the /blog/ endpoint, giving verbose PHP error messages when visiting a blog article such as https://www.hackerone.com/blog/H1-702-2018-makes-history-over-500K-bounties-paid. F374066 Impact Not much impact, just disclosures of pat...

careers-blog.chipotle.com XSS vulnerability

Open Bug Bounty ID: OBB-696715 Description| Value ---|--- Affected Website:| careers-blog.chipotle.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

Security Bulletin: IBM DataPower Gateway is affected by a Denial of Service vulnerability (CVE-2018-12115)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-12115 Vulnerability Details CVEID: CVE-2018-12115 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds write in Buffer. An attacker could exploit this vulnerability to write to memor...

OOP CMS BLOG 1.0 - search SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: OOP CMS BLOG 1.0 - 'search' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://zsoft.com.bd/ Software Link: https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blogforup.zip Version: 1.0 Category:...

OOP CMS BLOG 1.0 SQL Injection

Exploit Title: OOP CMS BLOG 1.0 - 'search' SQL Injection Dork: N/A Date: 2018-11-06 Exploit Author: Ihsan Sencan Vendor Homepage: http://zsoft.com.bd/ Software Link: https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blogforup.zip Version: 1.0 Category: Webapps Tested on:...

blog.mozilla.org Improper Access Control vulnerability

Open Bug Bounty ID: OBB-695400 Description| Value ---|--- Affected Website:| blog.mozilla.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:|...

OOP CMS BLOG 1.0 - 'search' SQL Injection

Exploit Title: OOP CMS BLOG 1.0 - 'search' SQL Injection Dork: N/A Date: 2018-11-06 Exploit Author: Ihsan Sencan Vendor Homepage: http://zsoft.com.bd/ Software Link: https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blogforup.zip Version: 1.0 Category: Webapps Tested on:...