CVE-2023-31086 WordPress Simple Giveaways Plugin <= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin = 2.46.0 versions...

CVE-2023-5049

CVE-2023-5049 affects the Giveaways and Contests by RafflePress plugin for WordPress. The flaw is Stored XSS via the rafflepress/rafflepress_gutenberg shortcode, caused by insufficient input sanitization and output escaping on the giframe attribute. Authenticated attackers with contributor or hig...

WordPress Plugin Giveaways and Contests by RafflePress Cross-Site Scripting Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. Cross-site scripting vulnerability exists i...

The Weird, Big-Money World of Cybercrime Writing Contests

The competitions, which are held on Russian-language cybercrime forums, offer prize money of up to $80,000 for the winners...

Cross site scripting

The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

WordPress plugin Giveaways and Contests by RafflePress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Giveaways and Contests by RafflePress < 1.11.3 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. rafflepress id='1' minheight="'; alert1; '"...

From Bounty to Exploit: Observations About Cybercriminal Contests

From articles to hackathons, cybercriminals are resorting to crowdsourcing to find more ways to exploit systems. In this blog, we discuss our takeaways and summarize the results of these contests...

Wizards 2020: Celebrating a community of innovators!

Wizards is a global ideation program that allows Akamai employees to submit their innovative ideas and contribute to the business transformation of Akamai. The program has been running for eight years and has received more than 5000 idea submissions. We are proud that Akamai products like Page...

GitLab Doles Out Half a Million Bucks to White Hats

GitLab has awarded a total of $565,650 in security bug bounties to 171 researchers who reported valid vulnerabilities in the past year — and has announced the winners of its latest hacking contest. GitLab, which started out as a web-based Git repository manager before moving into the DevOps...

Sharing research and discoveries at PWN2OWN

The annual PWN2OWN exploit contest at the CanSecWest conference in Vancouver, British Columbia, Canada, brings together some of the top security talent from across the globe in a friendly competition. For the participants, these events are a platform to demonstrate world-class skills and vie for...

Wassenaar, Bug Bounties and Vulnerability Rewards Programs

Bug bounties have gone from novelty to necessity, not only for enterprises looking to take advantage of the skills of an organized pool of vulnerability hunters, but also for a slew of independent researchers who make a living contributing to various vendor and independent bounty and reward...

Researchers, Vendors Await Google Disclosure Fallout

The endless loop that is the disclosure debate got a jolt of energy yesterday when Google said it would support researchers’ disclosure of details on actively exploited critical vulnerabilities just seven days after the researcher has notified the vendor in question. Google hopes the policy...

Getting Dirty

Other firms sponsor contests at DEFCON as well. Dirtbags is one. The organization hosts CTF style contests around the country that are modeled on the DEFCON CTF...

Contests, Contests and More Contests

Contests abound at DEFCON. In addition to the open and closed capture the flag tourneys, there’s a lock picking contest, shown here. The contestant in green shorts must free himself from a pair of handcuffs, then make his way across stage, picking locks as he goes...

Hackers Got "Wired In"

Competition in the CTF contests is intense, with teams of hackers “wired in” as they might say in The Social Network and crowded around tables filled with laptops, cabling, soda, booze and junk food. Age is no obstacle, either, with some of the most skilled and technical hackers unable to legally...

Dino Dai Zovi on Mac OS X Rootkits, Mac Exploitation and Hacking Contests

Dennis Fisher talks with security researcher Dino Dai Zovi about his upcoming Black Hat talk on Mac OS X rootkits, exploiting the Mac and the value of hacking contests and internal code reviews. Download SHOW NOTES: Dino Dai Zovi on Mac Security, ‘nomore free bugs’ Where is Apple’s Trustworthy...