9398 matches found
Information Disclosure
Moodle is vulnerable to information disclosure. A malicious user can read a non-public file if it is referenced in a public blog entry...
Microsoft Edge に関する報奨金プログラムの拡張
本記事は、Microsoft Security Response Center のブログ “Extending the Microsoft Edge Bounty Program” 2017 年 6 月 21 日 米...
Sensitive Information Disclosure
moodle/moodle is vulnerable to information disclosure attacks. A flaw in blog/rsslib.php continues to provide a blog RSS feed when blogging is disabled. Attackers can leverage this feed to obtain sensitive information...
進化したウイルス対策
本記事は、 Microsoft Malware Protection Center のブログ “Antivirus evolved” 2017 年 5 月 8 日 米国時間公開 を翻訳したも...
Tales from the MSRC: from pixels to POC
Is this thing still on? It’s been a while since we’ve posted to this blog and we think it’s time to start posting deep technical content about Security Research & Defense SRD again. For readers who are new or may have forgotten, this blog is the home of the MSRC Vulnerabilities & Mitigations...
Two SQL Injection Vulnerabilities in Axublog Blog System
axublog is a PHP personal blog system. Two SQL injection vulnerabilities exist in Axublog blog system. An attacker can exploit the vulnerabilities to obtain database information...
SQL Injection Vulnerability in the Frontend of Axublog Blog System
axublog is a PHP personal blog system. A SQL injection vulnerability exists in the frontend of the Axublog blog system. An attacker can exploit this vulnerability to obtain sensitive database information...
SQL Injection Vulnerability in Axublog Blog System
axublog is a PHP personal blog system. A SQL injection vulnerability exists in the Axublog blog system. An attacker can exploit this vulnerability to obtain sensitive information from the database...
Code Execution Vulnerability in Axublog Blogging System
axublog is a PHP personal blog system. A code execution vulnerability exists in the Axublog blog system. The vulnerability is caused due to the failure to validate the reloaded files, which can be exploited by an attacker to construct a specially crafted file, upload a shell, and gain...
Friday Squid Blogging: Squids from Space Video Game
An early preview. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...
The grugq on Reality Winner, the Intercept, and OPSEC
Good commentary...
wanderingroot.com XSS vulnerability
Vulnerable URL: http://www.wanderingroot.com/blog/2015/9/3/sweet-potato-egg-scramble/...
Comments from retricted blog post visible for unrestricted user
h5. Summary All comments made before the post restriction changed to "Viewing and editing restricted" will be available to all user in all updates. This is only happening for blog post, and page restriction working as expected. Tested in version 5.9.1customer's version and 6.1.3, same behavious c...
Safety and Security and the Internet of Things
Ross Anderson blogged about his new paper on security and safety concerns about the Internet of Things. See also this short video. It's very much along the lines of what I've been writing...
Sensitive Information Leak
Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...
Cross-site Scripting (XSS)
Moodle is susceptible to cross-site scripting XSS attacks. The attacks are possible because the parameter passed to blog/index.php is not properly sanitized. It allows the attackers to inject arbitrary web script or HTML through it when Internet Explorer is used...
SEI Issues Advice on Ransomware
The Software Engineering Institute SEI of Carnegie Mellon University has released a blog post on best practices for preventing and responding to ransomware. This common malware captures, encrypts, and holds your data to extort a ransom. SEI’s top recommendation to thwart ransomware attacks is to...
blog-food.ru XSS vulnerability
Vulnerable URL: https://blog-food.ru/search-results?query=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 10522...
Aries QWR-1104 Wireless-N Cross Site Scripting
Exploit Title: Aries QWR-1104 Wireless-N Router Execute JavaScript in Wireless Site Survey page. Date: 26-05-2017 Vendor Homepage : http://www.ariesnetworks.net/ Firmware Version: WRC.253.2.0913 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...