CVE-2017-13761

The CVE-2017-13761 issue affects the Fastly CDN module for Magento 2 prior to 1.2.26. When this module is used with a third-party authentication plugin, remote authenticated users may obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses. Aff...

PT-2017-13081

Name of the Vulnerable Software and Affected Versions Fastly CDN module for Magento2 versions prior to 1.2.26 Description The issue allows remote authenticated users to obtain sensitive information from authenticated sessions. This is possible when the Fastly CDN module is used with a third-party...

CVE-2017-13761: Exposure of Sensitive Information to an Unauthorized Actor

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

Top-5 stupid security mistakes in web apps

by Ivan Novikov Image by Byseyhanla Own work CC BY-SA 4.0, article re-posted from In this blog entry, I will summarize some commonly overlooked issues which have been affecting many web projects for the last 5 years. All of them are obvious and super predictable and could be used be script kiddie...

Moderate: Red Hat Security Advisory: satellite and spacewalk security and bug fix update

An update for satellite-schema, spacewalk-backend, spacewalk-java, and spacewalk-schema is now available for Red Hat Satellite 5.8 and Red Hat Satellite 5.8 ELS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base...

Incapsula Updated Review — New Security Options, Improved Delivery and Reliability

It's been close to five years since we last looked at Incapsula, a security-focused CDN service known for its DDoS mitigation and web application security features. As one would expect, during these five years the company has expanded and improved, introducing lots of new features and even severa...

cdn.accessmylogin.com XSS vulnerability

Vulnerable URL: http://cdn.accessmylogin.com/api/dynamic/4112/getItems.php?itemid=...

Shopify: Tinymce 2.4.0

Hello, The following url https://app.shopify.com//services/mobileapp/rte Loads https://cdn.shopify.com/s/assets/mobileapp/rte-bundle-f044a6c638b6c0500848c772dd5c86bf0eb2b27516c0860c6d3ddafde42231e2.js which is a minified tinymce 2.4.0. This version of tinymce has known vulnerabilities but in orde...

What’s new in Gartner WAF Magic Quadrant 2017?

To tell the truth, I was not much interested in Web Application Firewall market since the time when I was doing competitive analysis in Positive Technologies. And a few days ago Gartner published a fresh WAF research with interesting Magic Quadrants. I decided to figure out what's new there. Here...

cdn.na.sage.com XSS vulnerability

Vulnerable URL: http://cdn.na.sage.com/sagemail/SageHRMS/hrmstrainingcatalogue2014q4/bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnT1BFTiBCVUdCT1VOVFknKTwvc2NyaXB0Pg== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.10.2017 Vulnerability...

cdn.discordapp.com XSS vulnerability

Vulnerable URL: https://cdn.discordapp.com/attachments/290938712114855938/337966295754473474/profilepc.svg Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

Unwelcome Interruptions

Imagine your player's first experience with your game. Finally, after waiting all these years, she's got the game in hand. She tears the cellophane, cracks the case, slots the disc, and . . . "Game is now updating. Please wait." Watching 20 GB load onto a machine is not anyone's idea of fun. I ha...

Cookie consent from silktide, Unknown version, Other

Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...

Top-5 stupid security mistakes in web apps

In this blog entry, I will summarize some commonly overlooked issues which have been affecting many web projects for the last 5 years. All of them are obvious and super predictable and could be used be script kiddies as well as by fully automated scanners and internal security checks. Let’s go! 1...

Cross-Site Scripting

Overview Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url. Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if yo...

img.cdn.betclick.com XSS vulnerability

Vulnerable URL: http://img.cdn.betclick.com/img2/fr/creatives/generic/pokertonyparker/250x250.swf?clickTAG=javascript:alert%27Openbugbounty%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Serious Bug Exposes Sensitive Data From Millions Sites Sitting Behind CloudFlare

A severe security vulnerability has been discovered in the CloudFlare content delivery network that has caused big-name websites to expose private session keys and other sensitive data. CloudFlare, a content delivery network CDN and web security provider that helps optimize safety and performance...

CVE-2017-5393

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects...

PT-2017-16479

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 51 Description The issue allows for the installation of extensions from the CDN for addons.mozilla.org, which is a publicly accessible site. This could potentially enable malicious extensions to install additional...

Facebook, Researcher at Odds Over Messenger Issue

Facebook is dismissing claims by a researcher who says multimedia content such as audio-based messages sent via its Facebook Messenger service can be intercepted by a third-party under certain conditions. On Tuesday, Mohamed Baset, a security analyst at ecommerce firm Linio México, published a...