ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution

The plugin ProfileGrid – User Profiles, Groups and Communities versions prior to 2.8.6 is vulnerable to Arbitrary Code Execution. An authenticated user with a role as low as Subscriber can execute arbitrary PHP code on websites using the plugin. Send an authenticated POST request to...

Cisco Wireless LAN Controller Default Simple Network Management Protocol Community Strings

With new installations of Cisco Wireless LAN Controller Software, the installation scripts create default communities for Simple Network Management Protocol SNMP Version 2 SNMPv2 and a default username for SNMP Version 3 SNMPv3, both allowing for read and write access. As documented in the Cisco...

Getting Back on the Field

Growing up as a foreign service brat, I was obsessed with security. Living in Guatemala in the 80s you had to adapt and become resilient as child. As there was no TV in our household, 10-year-old Tom began to tinker with my father’s computer and soon it became my oasis from the stress of living i...

communities.bmc.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-453954 Description| Value ---|--- Affected Website:| communities.bmc.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

[SECURITY] Fedora 26 Update: moodle-3.2.6-1.fc26

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

Automated posting on Vkontakte public pages using VK API and Python

Vk.com Vkontakte is the most popular social network Russia and Ex-USSR with 430+ million users. Originally it was a Facebook clone. But now, after 10 years of development, these two services are quite different from each other. Traditional advantages of vk.com - huge amount of free music and vide...

genebglick.com XSS vulnerability

Vulnerable URL: http://www.genebglick.com/communities.php?senior=1"...

olthofhomes.com XSS vulnerability

Vulnerable URL: http://www.olthofhomes.com/communities/communities.php?city=1/-///'/"//--...

regencyapartments.com XSS vulnerability

Vulnerable URL: http://www.regencyapartments.com/Communities.asp?SearchCity=Champaign=1/-///'/"//--...

[SECURITY] Fedora 25 Update: moodle-3.1.5-1.fc25

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

The Japanese version of the WPS remote code execution vulnerability detailed analysis-vulnerability warning-the black bar safety net

Overview Word processing and work product in the vulnerability is the threat actors to exploit the useful target. Users often encounter in everyday life these software packages use the file type, and may in the email to open such a file, or be prompted to download from the website this file does...

[SECURITY] Fedora 25 Update: moodle-3.1.4-1.fc25

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

Zeus Variant 'Floki Bot' Targets PoS Data

Researchers have observed an uptick in attacks using the banking malware Floki Bot against U.S., Canadian and Brazilian banks, and insurance firms. Floki Bot, which uses code from the once notorious Zeus banking Trojan, has evolved and unlike its predecessor, is targeting point-of-sale systems vi...

[SECURITY] Fedora 23 Update: moodle-3.0.7-1.fc23

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

[SECURITY] Fedora 24 Update: moodle-3.0.4-1.fc24

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

communities.bmc.com XSS vulnerability

Vulnerable URL: https://communities.bmc.com/community/bmcdn/myit/tags?tags=%22%3E%3C/option%3E%3C%20/select%3E%3Cbody/onpageshow=prompt%28%29%3E%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 07.11.2016 Latest check for patch:| 07.11.2016 23:14...

[SECURITY] Fedora 24 Update: moodle-3.0.3-1.fc24

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

SQL Injection in webSPELL

High-Tech Bridge Security Research Lab discovered two vulnerabilities in a popular CMS webSPELL developed for the needs of esport related communities. The vulnerability allows a remote authenticated attacker with cashbox access privileges to execute arbitrary SQL commands in application’s databas...

[SECURITY] Fedora 22 Update: moodle-2.8.9-1.fc22

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

CVE-2015-4305

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656...