Linkedin Information Gathering Tool: raven

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Usage of this is application is pretty simple. It requires at least three parameters. The first one is the company name , the second one is the count...

Open Distributed Threat Intelligence: Yeti

Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. Yeti will also automatically enrich observables e.g. resolve domains, geolocate IPs so that you don’t have to. Yeti provides an interface for humans shiny...

Shopify: Removed staff members who had "Manage shops" permission can still create development stores

Details: It's been found that staff members of an organization in partners.shopify.com can have a permission to manage shops and those with that permission can create development stores that will be associated with the organization. When a staff member tries to create a development store, a POST...

Cross-site Scripting (XSS)

Moodle is vulnerable to multiple cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript through an organization name in mod/scorm/player.php or mod/scorm/prereqs.php...

Hansa Market on Dark Web seized by Dutch police

In a simultaneous press conference issued by the Dutch police and US Attorney General Jeff Sessions we learned that the Dark Web market places Alphabay and Hansa market have been seized and shut down by international cooperating authorities. As it turned out Hansa Market was already under control...

CVE-2017-7538

A cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users...

GSA Bounty: The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout

Description Hi. I found a non-critical session management bug, which still can have serious impact in some scenarios. When user perform login to the Federalist through Github, federalist checks his Organization ID but only upon login. When the user was deleted from organization for some reasons,...

niso.org XSS vulnerability

Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...

albemarle.org XSS vulnerability

Vulnerable URL: http://www.albemarle.org/department.asp?department=1"...

ICS & SCADA Situational Awareness: Grassmarlin

ICS & SCADA Situational Awareness GRASSMARLIN is an open-source software tool that provides a method for discovering and cataloging Supervisory Control & Data Acquisition SCADA and Industrial Control System ICS hosts on IP-based networks. GRASSMARLIN uses a variety of sources to generate this dat...

neaman.org.il XSS vulnerability

Vulnerable URL: http://www.neaman.org.il/Neaman2011/Templates/ShowPage.asp?DBID=1=2=131=266 Details: Description| Value ---|--- Patched:| Yes, at 26.11.2017 Latest check for patch:| 26.11.2017 15:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3973143 VIP...

Visualizing the Stack Clash Vulnerability with Dashboards

Security teams should apply vendor patches immediately to protect their Linux, OpenBSD, NetBSD, FreeBSD and Solaris infrastructure from The Stack Clash vulnerability also see the security advisory. To help in that effort, this blog post describes a new built-in Qualys AssetView dashboard to...

A Look at --- SharePoint's Follow Feature XSS(CVE-2017-8514 )

A Look at CVE-2017-8514 --- SharePoint's Follow Feature XSS TL;DR: All your SharePoint installations are belong to us. The XSS worth $2500 affecting both on-premises and online version looks like ... http|https://?FollowSite=0&SiteName='-confirmdocument.domain-' SharePoint needs no more marketing...

CVE-2017-0896

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...

Authorization

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

CVE-2017-7505

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

PhishingKitHunter - Find Phishing Kits Which Use Your Brand/Organization'S Files And Image

Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write in Python 3 - is...

Secure Mail gives Error: Your organization does not allow this action

- User opens Secure Mail. - Goes into Contacts. - Selects a contact. - Clicks on the contacts phone number. - Sees error message:Your organization does not allow this action...

ilo.org XSS vulnerability

Vulnerable URL: http://ilo.org/Search5/search.do?locale=%22%3E%3Ca%2Fhref%3Djavascript%26colon%3Bco%5Cu006efir%5Cu006d%26%2340%3B%26quot%3B1%26quot%3B%26%2341%3B%3Eclickme%3C%2Fa%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS...

New Relic: /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email"

Hello Team, Vulnerable Url: https://rpm.newrelic.com/accounts/USERID.json Description of the Bug: As Restricted user for an organization cannot Add New users to the Organization, cannot change Organization Name, cannot generate or download report as well as cannot read the information of Owner...