5569 matches found
A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup
Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led them to take a closer look. Turns out the attack was launched by a botnet and implemented in the form of comment SPAM - meaningless, generic text generated from a template...
CVE-2018-5882: Out-of-bounds Read
While parsing a Flac file with a corrupted comment block, a buffer over-read can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear...
A week in security (June 25 – July 1)
Last week on Labs, we looked at comment moderation duties, Viagra spam on a news-making restaurant's website, and how to manage your child's online presence for Internet safety month. We also looked at a set of big breaches and leaks, as well as malware threats with a World Cup vibe. Other news...
Did my comment on your blog get lost?
If you ever feel bad about your job because of mindless tasks you must perform day after day, or if you're bothered by the fact that your chosen work pays crap, produces nothing useful, and helps no one: have a look at blog comment spammers and breathe a sigh of relief. They make almost any job...
Airbnb Knowledge Repo Cross-Site Scripting Vulnerability
Airbnb Knowledge Repo is a suite of knowledge sharing platforms. The platform supports features such as data storage and utility management. A cross-site scripting vulnerability exists in Airbnb Knowledge Repo version 0.7.4. A remote attacker can exploit this vulnerability to inject arbitrary web...
Security Bulletin: Vulnerability in libxml2 affects IBM InfoSphere Streams. (CVE-2015-8710)
Summary There is a vulnerability in libxml2 that is used by IBM InfoSphere Streams. IBM InfoSphere Streams has addressed this vulnerability. Vulnerability Details CVE-ID: CVE-2015-8710 Description: Libxml2 is vulnerable to a denial of service, caused by an out-of-bounds memory access when parsing...
Valve: Comment restriction in subsection "Workshop" of domain "steamcommunity.com" can be bypassed using IDOR
Summary - While testing Domain "steamcommunity.com", i found subsection "workshop" which has restriction to comment on workshop items of the game which i do now own in my account. This access control can be bypassed using IDOR and user can post comment though comment section is disabled on worksh...
Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)
Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...
Unauthorized Access
drupal/drupal is vulnerable to unauthorized access attacks. The vulnerability exists in the Comment reply form where users who can post comments are able to view and add comments that they are not authorized to do so...
PT-2018-16832
Name of the Vulnerable Software and Affected Versions Symantec Advanced Secure Gateway ASG versions 6.6 through 6.7 ProxySG versions 6.5 through 6.7 Description The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing...
Cross site scripting
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
CVE-2018-11339: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment...
PT-2018-10496
Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to the fixed version Description A cross-site scripting XSS issue was discovered in Frappe ERPNext. The issue is related to a comment. Recommendations At the moment, there is no information about a newer version...
SAP Internet Graphics Server HTTP and RFC listener denial of service vulnerability
SAP Internet Graphics Server IGS is a graphics server from SAP, Germany. The product is able to generate graphs or charts in different areas.HTTP is one of the hypertext transfer protocols; RFC listener is one of the RFC listener. A security vulnerability exists in HTTP and RFC listener in SAP IG...
ERPnext 11 - Cross-Site Scripting
Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS CVE : CVE-2018-11339...
ERPnext 11 - Cross-Site Scripting
ERPnext 11 - Cross-Site Scripting Exploit Title: ERPnext 11.x.x - Cross-Site Scripting Date: 2018-05-10 Exploit Author: Veerababu Penugonda Vendor Homepage: https://erpnext.com/ Software Link: https://demo.erpnext.com/ Version: Frappe ERPNext v11.x.x-develop Tested on: Mozilla Firefox quantum 60....
ruibaby Halo Cross-Site Scripting Vulnerability
ruibaby Halo is a Java-based blogging system. A cross-site scripting vulnerability exists in ruibaby Halo version 0.0.2. A remote attacker can inject arbitrary web script or HTML by sending the commentAuthor field to the FrontCommentController.java file...