Annual Protest Raises $250K to Cure Krebs

For the second year in a row, denizens of a large German-language online forum have donated more than USD $250,000 to cancer research organizations in protest of a story KrebsOnSecurity published in 2018 that unmasked the creators of Coinhive, a now-defunct cryptocurrency mining service that was...

WordPress Donation Plugin and Fundraising Platform Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation, which supports personal blog sites on servers running PHP and MySQL.WordPress Donation Plugin and Fundraising Platform is a plugin.... A cross-site scripting vulnerability exists in the WordPress Donation Plug...

Cross site scripting

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9909

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9909

The CVE concerns the WordPress GiveWP plugin (Donation Plugin and Fundraising Platform). Affected component: csv export functionality (wp-admin/edit.php) in GiveWP versions prior to 2.3.1. Root cause: improper handling/sanitization of input during CSV export leads to a Cross-Site Scripting (XSS) ...

CVE-2018-20629

PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

Directory traversal

PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

PT-2019-19927 · Unknown · Donation Plugin/Fundraising Platform

Name of the Vulnerable Software and Affected Versions: Donation Plugin and Fundraising Platform versions prior to 2.3.1 Description: The issue concerns a cross-site scripting XSS vulnerability in the csv export functionality of the wp-admin/edit.php page. Recommendations: For versions prior to...

CVE-2018-20629

PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...

CVE-2018-20629

CVE-2018-20629 affects PHP Scripts Mall Charity Donation Script (readymadeb2bscript). The issue is a directory traversal vulnerability exposed by direct requests listing an uploads directory (e.g., wp-content/uploads/2018/12). Impact is partial confidentiality exposure; no exploitation or patch d...

New Zealand Tragedy-Related Scams and Malware Campaigns

In the wake of the recent New Zealand mosque shootings, the Cybersecurity and Infrastructure Security Agency CISA advises users to watch out for possible malicious cyber activity seeking to capitalize on this tragic event. Users should exercise caution in handling emails related to the shootings,...

TAU Threat Intelligence Notification – Fake Movie File Attack Targeting Cryptocurrency

A malicious Windows shortcut file is posing as a movie available on a torrent site - its payload is used to conduct web-injection, ultimately targeting victim’s web searches in browsers like Chrome, Firefox and Internet Explorer. The payload has the ability to search for and steal cryptocurrency...

Wallarm to Sponsor AppSec Cali

If you are a SecOps or DevOps professional on the west coast you can not miss the premier California application security event: AppSec California, January 22–25th in Santa Monica. Here are testimonials from the previous AppSec Cali events: “I'm looking forward to AppSecCali next week. Last year...

Dark Web Azorult Generator Offers Free Binaries to Cybercrooks

A malicious build-it-yourself platform for the Azorult info-stealing malware has debuted on the Dark Web. The online builder, which its authors have named Gazorp, allows cybercriminals to generate their very own strains of Azorult, along with the apparatus to control it. And, it’s free. “Threat...

Black Hat 2018: Google Bug Hunter Urges Apple to Change its iOS Security Culture

LAS VEGAS – Prolific Google bug hunter Ian Beer ripped into Apple on Wednesday, urging the iPhone maker to change its culture when it comes to iOS security. He said the company suffers from an all-too-common affliction of patching an iOS bug, but not fixing the systemic roots that contribute to t...

Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation

Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...

Tragedy-Related Scams

In the wake of the recent Texas school shooting, NCCIC advises users to watch out for possible malicious cyber activity seeking to capitalize on this tragic event. Users should exercise caution in handling emails related to the shooting, even if they appear to originate from trusted sources...

Charitable <= 1.5.13 - Unauthorised Access

From the vendor blog pos details: Fix a bug that can in certain scenarios allow unauthorized users to access the user and donation details of previous donations. Payment details such as credit card details were not exposed...

redcrossshimla.com XSS vulnerability

Open Bug Bounty ID: OBB-547425 Description| Value ---|--- Affected Website:| redcrossshimla.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Trend Micro Kicks Off 2018 In Vancouver Helping Those In Need

The holiday season is traditionally a time for friends and family, gift-giving and celebrations. But it’s also a time to remember those less fortunate than ourselves, and to do what we can to make their lives better. As a responsible corporate citizen, Trend Micro is always keen to find new ways ...