7174 matches found
register.aestheticforum.org Cross Site Scripting vulnerability OBB-1296736
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Pioneer Kitten APT Sells Corporate Network Access
An APT group known as Pioneer Kitten, linked to Iran, has been spotted selling corporate-network credentials on hacker forums. The credentials would let other cybercriminal groups and APTs perform cyberespionage and other nefarious cyber-activity. Pioneer Kitten is a hacker group that specializes...
Magecart’s Success Paves Way For Cybercriminal Credit Card 'Sniffer' Market
The Magecart threat group has dominated headlines for its use of malicious JavaScript code, which is injected into e-commerce websites to exfiltrate customer payment card data. But new research points to a growing industry on underground forums where so-called “sniffers” are being advertised, sol...
CVE-2020-15156
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation...
XSS due to lack of CSRF validation for replying/publishing
Impact Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. Patches Upgrade to the latest version v0.7.0 Workarounds You can cherry-pick the following commit:...
GHSA-43M5-C88R-CJVV XSS due to lack of CSRF validation for replying/publishing
Impact Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. Patches Upgrade to the latest version v0.7.0 Workarounds You can cherry-pick the following commit:...
vBulletin 5.6.2 - (widget_tabbedContainer_tab_panel) Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: vBulletin 5.6.2 - 'widgettabbedContainertabpanel' Remote Code Execution Exploit Author: @zenofex Vendor Homepage: https://www.vbulletin.com/ Software Link: None Version: 5.4.5 through 5.6.2 Tested on: vBulletin 5.6.2 on Ubuntu...
BBS forums suffer from SQL injection vulnerability
BBS Forum is a web application. BBS Forum has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...
Debian DLA-2316-1 : ruby-kramdown security update
ruby-kramdown processes the template option inside Kramdown documents by default, which allows unintended read access such as template='/etc/passwd' or unintended embedded Ruby code execution such as a string that begins with template='string://%= . NOTE: kramdown is used in Jekyll, GitLab Pages,...
PHPwind forum has XSS vulnerability
PHPwind is a website builder. PHPwind forums exist in the storage of XSS vulnerability, attackers can use the vulnerability to obtain sensitive information on the site...
Unintended read access in kramdown gem
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...
GHSA-MQM2-CGPR-P4M6 Unintended read access in kramdown gem
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...
Sensitive data of 900 Pulse Secure VPN servers leaked on hacker forum
By Sudais Asif The team behind Pulse Secure VPN had a year to fix the flaw but it did not get a fix. This is a post from HackRead.com Read the original post: Sensitive data of 900 Pulse Secure VPN servers leaked on hacker forum...
Authorization Bypass
mittwald/typo3forum is vulnerable to authorization bypass. The vulnerability exists as it allowed anonymous users to create forum posts even when they do not have permissions to do so...
csen.forum.dict.cc Cross Site Scripting vulnerability OBB-1249015
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GHSA-57GR-JVQR-3HWM Incorrect access control in typo3_forum
The typo3forum extension before 1.2.1 for TYPO3 has Incorrect Access Control...
Twitter Hacking for Profit and the LoLs
The New York Times last week ran an interview with several young men who claimed to have had direct contact with those involved in last weeks epic hack against Twitter. These individuals said they were only customers of the person who had access to Twitters internal employee tools, and were not...
CVE-2020-14001
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...
DEBIAN-CVE-2020-14001
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...
CVE-2020-14001
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...