Hashicorp vagrant-vmware-fusion 4.0.24 - Local Privilege Escalation

I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant. Unfortunately the 4.0.23 release which was supposed to fix the previous bug I reported didn't address the issue, so Hashicorp quickly put out another release - 4.0.24 - after that but didn't upda...

aruodas.lt XSS vulnerability

Vulnerable URL: https://www.aruodas.lt/butai/?obj=1=Importancetext=%22%3E%3Cscript%3Ealert/OPENBUGBOUNTY/%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 28686 VIP website status:| Yes Coordinated...

bluegreenkorea.co.kr XSS vulnerability

Vulnerable URL: http://www.bluegreenkorea.co.kr/bbs.php?table=helpdesk=%22%27--!%3E%3C/Title/%3C/Style/%3C/Script/%3C/c/%3C/Noscript/%3C/Pre/%3C/Xmp%3E%3CBody/OnPageShow=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...

ZeroNights 2017: back to the cyber 80s

Last Friday, 17th of November, I attended the ZeroNights 2017 conference in Moscow. And it was pretty awesome. Thanks to the organizers! Here I would like to share some of my impressions. First of all, I want to say that two main Moscow events for information security practitioners, PHDays and...

mathcelebrity.com XSS vulnerability

Vulnerable URL: http://www.mathcelebrity.com/search.php?q=drtj%22%27--!%3E%3CScript%20/K/%3Econfirm1%3C/Script%20/K/%3E=0=0 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 80121 VIP website status:| No Coordinate...

brillianshop.com XSS vulnerability

Vulnerable URL: https://brillianshop.com/app/goods/search.php/%22%3E%3Cimg%20src=x%20onerror=alert%27XSS%27%3E// Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9730631 VIP website status:| No Coordinated...

Trello: Able to run script on https://trello-attachments.s3.amazonaws.com/ [N/A]

HI Trello Security Team this pratik From India ------------------------------------------------------------------------------ I have Founded Stored XSS On your Website critical issue need to be patched before someoneattacker exploit this...

mygreenglobe.co XSS vulnerability

Vulnerable URL: http://mygreenglobe.co/social/mygreenglobe/company-overview.php?searchid=%22%3E%3Csvg%3E%3Cscript%3E/%3C@/%3Eprompt/OPENBUGBOUNTY/%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

groups.ch XSS vulnerability

Vulnerable URL: http://www.groups.ch/de/kontaktgruppen.html?action=kontakt Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 786320 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--...

3 Reasons to Use VMware NSX with Trend Micro Deep Security

Enterprises have begun adopting network virtualization for their IT infrastructure. According to a 2016 survey conducted by Accenture, 95 percent of small, medium, and large enterprises believe “network services will be virtualized.” Meanwhile, 25 percent of those who have adopted network...

dalesman.uk.com XSS vulnerability

Vulnerable URL: http://www.dalesman.uk.com/products.php?suppID=d3v2%27%22%3E%3CsVg%2FoNLoad%3Dprompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6660412 VIP website status:| No Coordinated...

masgroup.org XSS vulnerability

Vulnerable URL: http://masgroup.org/svc.php?id=13'" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1410118 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability...

danceofstreet.lv XSS vulnerability

Vulnerable URL: http://www.danceofstreet.lv/price.php?id=8%22%3E%3Csvg%3E%3Cscript%3E/%3C@/%3Eprompt/OPENBUGBOUNTY/%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6824640 VIP website status:| No...

pastorchrislive.net XSS vulnerability

Vulnerable URL: http://pastorchrislive.net/ChristmasEve2016/register.php?id=385%22%3E%3Csvg%3E%3Cscript%3E/%3C@/%3Eprompt/OPENBUGBOUNTY/%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1993824 VIP...

Rockwell Automation Patches Wireless Access Point against Krack

Rockwell Automation has patched its Stratix wireless access point against the KRACK vulnerability, joining a growing list of vendors in the commercial and industrial controls spaces moving quickly to reduce their exposure. Most major vendors have similarly patched their products, some prior to th...

Citrix App Layering 4.x: Best Practices

Table of Contents Operating System Layer Operating System Patching Platform Layers Application Layers - Before Install Installation Applications Application Patching Elastic Layers Maintenance Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

App Layering 2.x/3.x: Best Practices

A consolidation of the various layering best practices to apply in the OS and App layers. For App Layering 4.x Best Practices, please refer here:https://support.citrix.com/article/CTX225952 Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Rockwell Automation Stratix 5100 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.9 ATTENTION: Exploitable remotely/public exploits are available Vendor: Rockwell Automation Equipment: Stratix 5100 Wireless Access Point/Workgroup Bridge Vulnerability: Reusing a Nonce 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Protecting Xero’s Cloud-Based Accounting Platform from Cyber Attacks

Meeting with customers is always insightful, and recently I got a chance to sit down with Aaron McKeown, head of security engineering and architecture at Xero, to talk about how they use Imperva SecureSphere for their cloud-hosted applications. Founded in 2006, Xero provides cloud accounting...

orderfood.com.cy XSS vulnerability

Vulnerable URL: http://orderfood.com.cy/searchResult.php?searcharea=La=%22%3E%3CimG/sRc=l%20oNerrOr=prompt/OPENBUGBOUNTY/%20x%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 19.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...