Brutal

Ahora Teensy se puede usar para pentesting Teensy es como un rubber ducky, ¿por qué elegí Teensy? Porque el precio es muy barato para mí. Es extremadamente útil para ejecutar scripts en una máquina objetivo sin necesidad de interacción humano-teclado HID-ATTACK. Cuando insertas el dispositivo, se...

EUVD-2023-34080

Malicious code in bioql PyPI...

CVE-2023-2606

The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cryptocurrency Thefts Get Physical

Long story of a $250 million cryptocurrency theft that, in a complicated chain events, resulted in a pretty brutal kidnapping...

CVE-2023-2606

The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2606

The CVE refers to WP Brutal AI, a WordPress plugin, with versions before 2.06 vulnerable to Stored XSS due to incomplete sanitisation/escaping of settings. Affected: WP Brutal AI plugin for WordPress; root cause: improper sanitisation/escaping of settings; impact: stored XSS that could be exploit...

PT-2023-20457

Name of the Vulnerable Software and Affected Versions WP Brutal AI WordPress plugin versions prior to 2.06 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

WordPress plugin WP Brutal AI cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-2606: Undefined Security Weakness

The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress WP Brutal AI Plugin < 2.06 is vulnerable to Cross Site Scripting (XSS)

Software WP Brutal AI Type Plugin Vulnerable versions 2.06 Fixed in 2.06 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2606 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 658179337e78 Credits Taurus Omar Required privilege...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI " 3. Save the changes to trigger XSS. Classification: Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/62deb3ed-a7e4-4cdc-a615-cad2ec2e1e8f...

WordPress WP Brutal AI Cross Site Request Forgery / SQL Injection

Tittle: WordPress Plugin WP Brutal AI 2.0.0 - SQL Injection via CSRF References: CVE-2023-2601 Author: Taurus Omar Description: The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF. Affects Plugin...

WordPress WP Brutal AI Cross Site Scripting

Tittle: WordPress Plugin WP Brutal AI 2.0.1 - Admin + Reflected XSS References: CVE-2023-2605 Author: Taurus Omar Description: The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logge...

CVE-2023-2605 WP Brutal AI < 2.0.1 - Admin+ Reflected XSS

The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin...

WordPress plugin WP Brutal has an SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exists i...

WordPress plugin WP Brutal AI has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress WP Brutal AI Plugin < 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Brutal AI Type Plugin Vulnerable versions 2.0.1 Fixed in 2.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2605 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID de920688e9b7 Credits Taurus Omar Required privileg...

WordPress WP Brutal AI Plugin < 2.0.0 is vulnerable to SQL Injection

Software WP Brutal AI Type Plugin Vulnerable versions 2.0.0 Fixed in 2.0.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2601 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID f38258806195 Credits Taurus Omar Required privilege Administrator Published ...

CouchPotato: CIA Hacking Tool to Remotely Spy On Video Streams in Real-Time

After disclosing CIA's strategies to hijack and manipulate webcams and microphones to corrupt or delete recordings, WikiLeaks has now published another Vault 7 leak, revealing CIA's ability to spy on video streams remotely in real-time. Dubbed 'CouchPotato,' document leaked from the CIA details h...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 3, 2017

It has been quoted by Albert Einstein, Benjamin Franklin, and others that insanity is “doing the same thing over and over again and expecting different results.” I could say that in our world of cyber security, despite all the headlines about data breaches and ransomware, there is no “insanity.”...