The Showdown: Hackers vs. Accountants

By Waqas A showdown between hackers and accountants is unlikely to have This is a post from HackRead.com Read the original post: The Showdown: Hackers vs. Accountants...

High Schooler Nets $10,000 For Google Bug

Google fixed a bug last month that could have let anyone access an internal Google website and in turn access sensitive data. The company awarded a hefty $10,000 bounty to the researcher that uncovered it, Ezequiel Pereira, an Uruguayan high school student, last Friday. Pereira stumbled upon the...

MSRC の 2017 年 “トップ 100 人” セキュリティ研究者一覧

本記事は、Microsoft Security Response Center のブログ “The MSRC 2017 list of “Top 100” security researchers”...

Snapchat: RCE/LFI on test Jenkins instance due to improper authentication flow

@nahamsec found a test Jenkins instance where they could login with any valid Google account. Once logged in, they gained the ability to execute arbitrary code via the Jenkins Script Console. This was a test jenkins instance with no access to source code or resources. Methodology Here is the...

SecuriTeam Secure Disclosure

Hi all, In the past 10 years Beyond Security runs a vulnerability disclosure program called SecurTeam Secure Disclosure SSD. We are looking to acquire high end vulnerabilities in various stages of research, PoC and similar. We also runs Hack2Win online competition. Hack2Win online is a hacking...

Friends in War Make or Break SQL Injection Vulnerability

Make or Break is a is a parenting blog. Friends in War Make or Break suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information such as data...

Eternal Synergy Exploit Analysis

Introduction Recently we announced a series of blog posts dissecting the exploits released by the ShadowBrokers in April 2017; specifically some of the less explored exploits. This week we are going to take a look at Eternal Synergy, an SMBv1 authenticated exploit. This one is particularly...

alfaromeoofscottsdale.com XSS vulnerability

Vulnerable URL: http://www.alfaromeoofscottsdale.com/blog/2017/february/15/youre-invited-2017-alfa-romeo-giulia-launch-party-feb-24.htm/"--!"/ Details: Description| Value ---|--- Patched:| Yes, at 27.11.2017 Latest check for patch:| 27.11.2017 09:39 GMT Vulnerability type:| XSS Vulnerability...

Learning PowerShell: The basics

I bet I went about learning PowerShell the wrong way, so I may need your help, readers of this blog. If only to organize my knowledge and use it for the fight against malware and not just to figure out how it was used in malware. The first serious look I had at PowerShell was when I was trying to...

Friday Squid Blogging: Why It's Hard to Track the Squid Population

Counting squid is not easy. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Information Disclosure

Moodle is vulnerable to information disclosure attacks. When viewing comments on a blog post, there is no verification of viewing permissions. This allows attackers to read the comments that can potentially contain sensitive information...

blog.teengayhardcore.com XSS vulnerability

Vulnerable URL: http://blog.teengayhardcore.com/?nats=t" onmouseover=alert/OPENBUGBOUNTY/;MC4wLjExMy4xMTQuMC4wLjAuMC4w Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

blog.gaygroupsexvideos.com XSS vulnerability

Vulnerable URL: http://blog.gaygroupsexvideos.com/?nats=t" onmouseover=alert/OPENBUGBOUNTY/;MC4wLjExMy4xMTQuMC4wLjAuMC4w Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / No...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2017-18106)

Subrion CMS is a powerful and easy-to-use PHP content management system with full source editing, per-page permissions, user activity monitoring and other powerful features. Subrion CMS suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject arbitrary...

CVE-2017-10795

Cross-site scripting XSS vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

CVE-2017-10795

Cross-site scripting XSS vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

CVE-2017-10795

Cross-site scripting XSS vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

WakaTime: HTML - injection

Hello try to write this Done test in the comments it will run. https://wakatime.com/blog/26-download-your-team-activity-as-csvcomments...

CVE-2017-10795: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

PT-2017-11509

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.1.4 Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the body to "blog/add/". This enables attackers to execute malicious scripts on...