How the Feds Failed to Track Thousands of Separated Children

Ad hoc systems and haphazard databases made the Trump administration’s cruel border separation policies somehow even worse...

Wicked scammers steal $1 million from Save the Children charity

By Uzair Amir Another day, another email scam - This time, wicked scammers have stolen over $1,000,000 from Save the Children, an international non-governmental organization based in London, United Kingdom. This happened after scammers compromised email address of one of the Save the Children...

WebKit WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free

WebKit: Use-after-free in WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded CVE-2018-4197 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

FTC Promotes Resources to Prevent Cyberbullying

The Federal Trade Commission FTC has released an announcement on the importance of addressing cyberbullying. As children return to school, FTC encourages parents and educators to monitor kids' online activity and engage in conversations about preventing cyberbullying. NCCIC encourages users to...

Super CMS Blog Pro PHP Script 1.0 SQL Injection / Shell Upload

Exploit Title: Super Cms Blog Pro PHP Script v1.0 - Upload shell & SQL Injection Google Dork: N/A Date: 2018/25/7 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/Seunex Software Buy:...

A week in security (June 11 – June 17)

Last week on Malwarebytes Labs, we discussed how to protect the online privacy of children, we gave you a spring 2018 overview of exploit kits, rounded up the ongoing discussions about the VPNFilter malware, and discussed the struggles of UK law enforcement with modern-day cybercrime. Other news...

Test Your IQ 1.1 SQL Injection

Exploit Title: Test Your IQ v1.1 - SQL Injection Google Dork: inurl:"/index.php?page=vysledek" Date: 2018/25/04 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://testyouriqnow.com/ Software Buy: https://codecanyon.net/item/test-your-iq/6400433 Demo:...

Circle with Disney WiFi Insecure Access Point Vulnerability

Summary An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to setup an Access Point with default credentials. An attacker needs to send a series of spoofed “de-auth” packets to trigger this...

Investors concerned about smartphone addiction; Apple responds with new webpage

Hot on the heels of an open letter from investors urging Apple to do more to protect children from smartphone addiction, the tech giant has recently dedicated a page on their website to families. The "Families" page, which can be accessed at apple.com/families, contains tools parents can use to s...

Apps Exposing Children to Porn Ads Booted From Google Play

Sixty app were removed from the Google Play marketplace in December that were infected with malware dubbed AdultSwine that in some cases generated pornographic ads on apps aimed at children. The developers behind the malicious apps also scammed victims with scareware techniques and attempted to...

Trend Micro Kicks Off 2018 In Vancouver Helping Those In Need

The holiday season is traditionally a time for friends and family, gift-giving and celebrations. But it’s also a time to remember those less fortunate than ourselves, and to do what we can to make their lives better. As a responsible corporate citizen, Trend Micro is always keen to find new ways ...

User Login And Management PHP Script 1.0 Cross Site Scripting

Exploit Title: User Login and Management PHP Script - xss Google Dork: N/A Date: 2018/06/01 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/ajay138 Software Buy: https://codecanyon.net/item/user-login-register-and-user-management/9617985...

Chatting System PHP Ajax MySQL JavaScript 1.0 Shell Upload

Exploit Title: Chatting System PHP Ajax MySQL JavaScript - Remote Shell Upload Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/IngeniousDeveloper Software Buy:...

Chatting System PHP Ajax MySQL JavaScript 1.0 Cross Site Scripting

Exploit Title: Chatting System PHP Ajax MySQL JavaScript - xss Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/IngeniousDeveloper Software Buy:...

phpMars 1.0.9 Cross Site Scripting Vulnerability

phpMars version 1.0.9 suffers from a cross site scripting vulnerability. Exploit Title: phpMars - Photos Social Network instagram clone - Cross Site Scripting Google Dork: N/A Date: 2017/20/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://grohsfabian.com...

Roommate And Real Estate Listing Classified Response 1.0 XSS

Exploit Title: Roommate and Real Estate Listing Classified Responsive Web Application - Cross Site Scripting Google Dork: N/A Date: 2017/22/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://igslbd.com Software Buy:...

Online Hotel Booking System Pro 1.3 Cross Site Scripting Vulnerability

Online Hotel Booking System Pro version 1.3 suffers from a cross site scripting vulnerability. Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting Google Dork: N/A Date: 2017/08/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage:...

DEBIAN-CVE-2017-17497

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service Segmentation Fault, because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value...

CVE-2017-17497

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service Segmentation Fault, because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value...

Circle with Disney WiFi Restart SSID Parsing Command Injection Vulnerability(CVE-2017-2915)

Summary An exploitable vulnerability exists in the WiFi configuration functionality of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to execute arbitrary shell commands. An attacker needs to send a couple of HTTP requests and setup an access point...