Discourse: Any authenticated user can download full list of users, including email

The ExportCsvController allows users to export different types of entities, if one has guardian access: https://github.com/discourse/discourse/blob/master/app/controllers/exportcsvcontroller.rbL6 However, the guardian check only checks that the entity type is not "admin":...

bramptonguardian.com XSS vulnerability

Vulnerable URL: http://www.bramptonguardian.com/search/allarticles/?q=%3cimg%20src%3dx%20onerror%3dprompt%2fopenbugbounty%2f%3e=brampton-on=datedesc Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 247057 VIP...

Coalition of Cryptographers, Researchers Urge Guardian to Retract WhatsApp Story

A coalition of some of the globe’s top researchers and cryptographers are pleading with The Guardian to retract a story it published last week in which it suggested the encrypted messaging app WhatsApp contained a backdoor. The article, citing research by Tobias Boelter, a cryptography and securi...

Secure Anti Forensic Anonymous Operating System: kodachi

Secure Anti Forensic Anonymous Operating System Linux Kodachi operating system is based on Debian 8.6 it will provide you with a secure, anti forensic, and anonymous operating system considering all features that a person who is concerned about privacy would need to have in order to be secure...

contribute.theguardian.com XSS vulnerability

Vulnerable URL: https://contribute.theguardian.com/eu?INTCMP="%3E%3Csvg onload=alert'OPENBUGBOUNTY'%3E// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

southwalesguardian.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-178206 Description| Value ---|--- Affected Website:| southwalesguardian.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

wandsworthguardian.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-178197 Description| Value ---|--- Affected Website:| wandsworthguardian.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

croydonguardian.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-178202 Description| Value ---|--- Affected Website:| croydonguardian.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

wilmslowguardian.co.uk XSS vulnerability

Vulnerable URL: http://www.wilmslowguardian.co.uk/search/?search=%27prompt%22OPENBUGBOUNTY%22,%2f%2f Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1504073 VIP website status:| No...

northwichguardian.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-178082 Description| Value ---|--- Affected Website:| northwichguardian.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

guardian.wildernesswatch.org XSS vulnerability

Vulnerable URL: http://guardian.wildernesswatch.org/admin/index.php?page=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown /...

leylandguardian.co.uk XSS vulnerability

Vulnerable URL: http://www.leylandguardian.co.uk/search?query=lol%20hi=%22-alert%28%22XSSPOSED%22%29-%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2447505 VIP website status:|...

Spirit Guardian - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Spirit Guardian published at the 'play' market has multiple vulnerabilities...

somersetguardian.co.uk XSS vulnerability

Vulnerable URL: http://www.somersetguardian.co.uk/search/search.html?searchType==%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E= Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 09:32 GMT Vulnerability type:| XSS Vulnerability status:|...

ProtWare HTML Guardian 6.x Encryption Weakness

No description provided by source. source: http://www.securityfocus.com/bid/7169/info A weakness has been reported in the encryption scheme used by ProtWare HTML Guardian. Specifically, the encryption scheme implemented obfuscates data using a simple bit shifting technique, making it trivial for...

NSA can access your data on Smartphones including iPhone, BlackBerry and Android devices

National Security Agency NSA has the capability to access a broad range of data on most Smartphones out there, including iPhone, BlackBerry, and Android devices, according to the documents provided by former US intelligence contractor Edward Snowden to the German news agency Der Spiegel report. A...

Financial Times hacked by Syrian Electronic Army

The Financial Times has become the latest news outlet to be hacked by supporters of the Syrian president Bashar al-Assad, following a phishing attack on the company's email accounts. The posh broadsheet's Tech Blog - at https://blogs.FT.com/beyond-brics was compromised to run stories headlined...

Syrian Electronic Army Hijacks The Guardian's Twitter Accounts

The Guardian's Twitter accounts have been taken over by pro-Syrian government hackers 'Syrian Electronic Army' , who previously targeted the Associated Press BBC, al-Jazeera, the Qatari government and National Public Radio in the United States, as well as France 24 TV. "We are aware that a number...

New Fraud Ring 'Operation High Roller' Targets the Rich

A recent fraud ring through which attackers raided high-value bank accounts, nicknamed Operation High Roller .PDF, employed attacks that were quick, required no human interaction and have already affected several tiers of credit unions, regional banks and large global banks, over the last several...

Facebook Letting Users Designate 'Guardian Angel' Friends To Restore Locked Accounts

Social networking giant Facebook said on Thursday that it is testing a feature that will allow users to designate certain friends as ‘guardian angels’ entrusted with helping the user to recover a locked or hijacked account. The company, which has already experimented with forms of “social...