A week in security (January 15 – January 21)

Last week on Labs, we gave you some background information about cookies, specifically which ones to worry about and why. We also warned you about scams surrounding the Mega Millions winner, who promised to donate his money to good causes. We analyzed a cryptocurrency miner using a very old...

Multiple vulnerabilities in the Family Matters App

The Home Care App is a professional home service booking online platform. Worry-Free Home App suffers from arbitrary account login and cross-site scripting vulnerabilities, which can be exploited by an attacker to login to any account, insert cross-site code, and obtain sensitive information such...

Cross-domain high-risk vulnerability in WebView component for iOS platforms

WebView is an iOS control for displaying web pages, which is based on the Webkit engine and presents a web page.In addition to the properties and settings of a typical View, WebView controls can handle URL requests, page loading, rendering, and page interactions. The iOS platform WebView componen...

Showmax: Stored blind xss on showmax support team

This report describes a phishing attack. It was performed through html injection into 3rd party chat application and a bit of social engineering. The merit of the attack was in providing html code which was then executed on the support agent side. The code was able to retrieve some cookies and lu...

Reflective Cross-Site Scripting Vulnerability in DedeCMS V5.7 SP2

Weaving dream content management system DedeCms is a PHP open source website management system. A reflective cross-site scripting vulnerability exists in DedeCMS V5.7 SP2. The attacker constructs XSS statements and performs pop-up box operations to obtain user cookies and other information...

WordPress read-and-understood plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of the blogging platform, the platform supports PHP and MySQL server set up a personal blog site. read-and-understood plugin is the use of one of the use of the document reading plugin . A cross-site request forge...

WordPress dark-mode plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . dark-mode plugin is used in one of the night mode plugin . A cross-site scripting vulnerability exists in...

WordPress responsive-coming-soon-page plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site request...

Cookies: Should I worry about them?

Starting off the new year, many of us are worried about cookies—how many we ate over the holidays and how we're going to avoid them in the break room, for example. With so much cybercrime and data theft swirling around like daily bomb cyclones, there's more than a few folks worried about the kind...

Taxi Booking Script 1.0 - Cross-site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo:...

Taxi Booking Script 1.0 - Cross-site Scripting

Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Date: 11.01.2018 Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo: http://demo.phpjabbers.com/1515648238792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01 Version: 1.0 Category:...

Fedora 26 : webkitgtk4 (2017-0ad0e2f390)

This update addresses the following vulnerabilities : - CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856 Additional fixes : - Make WebDriver implementation more spec compliant. - Fix a bug when trying to remove cookies before a web process is spawned. - WebKitWebDriver process no...

Cross-site Scripting Vulnerability in eHR Human Resource Management System

The whole eHR human resource management system is a series of enterprise integrated management software produced by the whole software, which provides excellent software solutions for the development and management of enterprise personnel resources. A cross-site scripting vulnerability exists in...

WordPress Add Link to Facebook Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Add Link to Facebook is one of the plug-ins to automatically add links to Facebook. A cross-site scripting...

WordPress Simple Download Monitor plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Simple Download Monitor plugin is used in one of the download monitor plugin. A cross-site scripting vulnerability...

LocalTapiola: Reflected XSS Vulnerability in https://www.lahitapiola.fi/cs/Satellite

Basic report information Summary: Reflected XSS vulnerability in https://www.lahitapiola.fi/cs/Satellite. Description: There exists a reflected XSS vulnerability in https://www.lahitapiola.fi/cs/Satellite?pagename=TAMaster/FWBlogAsset/FWNav. Value of query string parameter rendermode is not...

Cross-Site Scripting Vulnerability in TRS MAS of Beijing Tops Information Technology Co.

TRS MAS is a universal media management system based on the characteristics of audio and video usage in the mobile Internet era. The same audio and video resources can be provided for different terminal platforms, effectively saving costs and simplifying operations. TRS MAS has a cross-site...

GOWPT - Go Web Application Penetration Test

GOWPT is the younger brother of wfuzz a swiss army knife of WAPT, it allow pentester to perform huge activity with no stress at all, just configure it and it's just a matter of clicks. How to install To install gowpt just type: make sudo make install Usage From the -h menu Usage of gowpt: -H valu...

CVE-2017-17735

CMS Made Simple CMSMS before 2.2.5 does not properly cache login information in cookies...

The vulnerability of the BIGIPAuthCookie service in the iControl REST interface of the BIG-IP product line allows a attacker to gain access to the interface.

The vulnerability of the BIGIPAuthCookie service in the iControl REST interface of the BIG-IP product line is related to an incorrect session expiration time. Exploiting this vulnerability allows a malicious actor to gain access to the iControl REST interface by converting outdated cookie files...