Twitter Discloses Suspected State-Sponsored Attack After Minor Data Breach

Twitter has been hit with a minor data breach incident that the social networking site believes linked to a suspected state-sponsored attack. In a blog post published on Monday, Twitter revealed that while investigating a vulnerability affecting one of its support forms, the company discovered...

Twitter Draws Data Privacy Concerns with Two New Bugs

Two recently-patched flaws in Twitter’s platform have reignited concerns about user data-privacy issues. On Monday, the social-media giant revealed a hole that accidentally enabled bad actors to pull the country codes of accounts’ phone numbers – and revealed that several IP addresses located in...

Domain Name Consolidation - Observations from the Field

Domain Name Consolidation The market and marketing of Web property domain names is changing. Companies prefer to promote top level domains TLDs, have the option of selecting brand-relevant domain extensions e.g. SaaS.com, and no longer need country-relevant domains to optimize search engine resul...

HackerOne: A user can request a report to be retested even though the program has not been verified by HackerOne

Hey Team I have some observations and issues which i found in my recent testing on h1 platform related to creation of a new private program , So here are my observations listed below - kindly have a look and revert back if you feel like these are valid and worth reporting issues. 1 Can A program...

CVE-2018-19340

Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter...

The US Is the Only Country Where There Are More Guns Than People

The US has the worst rate of gun violence among all developed countries, and still we fail to regulate...

AlienIP 2.41 - Denial of Service (PoC)

AlienIP 2.41 - Denial of Service PoC Exploit Title: AlienIP 2.41 - Denial of Service PoC Author: Arturo de la Cruz Tellez Discovery Date: 2018-10-17 Vendor Homepage: http://www.armcode.com Tested Version: 2.41 Tested on OS: Microsoft Windows 10 Home Single Language x64 Versión 10.0.10240...

ThreatList: Password Hygiene Remains Lackluster in Global Businesses

When it comes to password behaviors in the workplace, the average business is doing just an okay job, scoring a middling score in a credentials-security benchmarking analysis of organizations’ habits. Notably, the data also shows that password-sharing is still prevalent in the workplace – althoug...

cicerone.org XSS vulnerability

Open Bug Bounty ID: OBB-679192 Description| Value ---|--- Affected Website:| cicerone.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Air Canada Suffers Data Breach — 20,000 Mobile App Users Affected

Air Canada has confirmed a data breach that may have affected about 20,000 customers of its 1.7 million mobile app users. The company said it had "detected unusual log-in behavior" on its mobile app between August 22 and 24, during which the personal information for some of its customers "may...

country-haven.ca XSS vulnerability

Open Bug Bounty ID: OBB-658311 Description| Value ---|--- Affected Website:| country-haven.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2018-13459)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in the product/card.php...

CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

UBUNTU-CVE-2018-13448

SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the countryid parameter...

travelcar.com XSS vulnerability

Open Bug Bounty ID: OBB-638077 Description| Value ---|--- Affected Website:| travelcar.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Are Free Societies at a Disadvantage in National Cybersecurity

Jack Goldsmith and Stuart Russell just published an interesting paper, making the case that free and democratic nations are at a structural disadvantage in nation-on-nation cyberattack and defense. From a blog post: It seeks to explain why the United States is struggling to deal with the "soft"...

Celebrating the life of Tamir Segal

Trend Micro may be a global organization of more than 5,000 employees, but we’re also a tight-knit family. So it was with great sadness and shock that we heard of the passing of Tamir Segal, who has served as our Israel Country Manager for the past eight years. Our thoughts and prayers are with h...

geoip-lite-country code execution vulnerability

geoip-lite-country is a lite version of the geoip-lite library for querying the location of IP addresses, supporting only country queries for IPs. A security vulnerability exists in versions of geoip-lite-country prior to 1.1.4, which originates when a program downloads a data resource over the...

Design/Logic Flaw

geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10568

geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks...