MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting

MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Date: 4/20/2018 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914...

CVE-2018-5758

creationtimestamp| type| source ---|---|--- 2018-03-10 11:23:06+00:00| published-proof-of-concept| https://t.me/canyoupwnme/3408 2018-03-10 15:10:00+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/1158 2024-06-22 09:28:36+00:00| published-proof-of-concept|...

CVE-2017-18195

An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...

Deserialization of untrusted data

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

CVE-2018-7198 affects October CMS up to version 1.0.431, specifically the RainLab Blog Plugin. It enables stored XSS by entering HTML on the Add Posts page, allowing a malicious payload to be stored and subsequently executed. The issue is documented across multiple sources (GHSA/OSV and exploit r...

Dropbox: Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScript

The reporter informed us of both stored XSS vulnerabilities as well as unsafe css attributes that were allowed in forum posts due to TinyMCE editor. An upgrade to lithium's forum platform appears to have mitigated these vulnerabilities...

CVE-2017-15399

creationtimestamp| type| source ---|---|--- 2018-01-29 14:31:45+00:00| published-proof-of-concept| https://t.me/R0Crew/405 2018-01-30 05:26:35+00:00| published-proof-of-concept| https://t.me/br0wsec/25 2018-01-30 07:40:25+00:00| published-proof-of-concept| https://t.me/antichat/774 2018-01-30...

WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery Privilege Escalation

WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery Privilege Escalation Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage:...

WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery Privilege Escalation

WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery Privilege Escalation Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/...

WordPress CMS Tree Page View 1.4 Plugin - Cross-Site Request Forgery / Privilege Escalation Exploit

Exploit for php platform in category web applications Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link:...

WordPress CMS Tree Page View 1.4 CSRF / Privilege Escalation

Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link: https://wordpress.org/plugins/cms-tree-page-view Version: 1.4 Tested on:...

WordPress Admin Menu Tree Page View 2.6.9 CSRF / Privilege Escalation

Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link: https://wordpress.org/plugins/admin-menu-tree-page-view Version: 2.6.9...

VK.com: CSRF в m.vk.com

Отсутствие проверки хеша при скрытии записей в мобильной ленте...

CVE-2017-11882

creationtimestamp| type| source ---|---|--- 2017-11-15 11:11:01+00:00| exploited| https://t.me/informationsecuritychannel/11068 2017-11-15 18:56:28+00:00| seen| https://t.me/cybershit/173 2017-11-15 21:50:34+00:00| exploited| https://t.me/informationsecuritychannel/11105 2017-11-21 07:39:51+00:00...

My Blogging

Blog regulars will notice that I haven't been posting as much lately as I have in the past. There are two reasons. One, it feels harder to find things to write about. So often it's the same stories over and over. I don't like repeating myself. Two, I am busy writing a book. The title is still:...

EMC RSA Archer Privilege Bypass Vulnerability

EMC RSA Archer is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A privilege bypass vulnerability exists in EMC RSA Archer. A remote...

FIN10 Extorting Canadian Mining Companies, Casinos

Cybercriminals targeting casinos and mining firms in North America have extorted as much as $620,000 per theft during a four-year run in which they threaten victims with the destruction or public release of stolen data. Between 2013 and 2016, mostly Canadian firms were hit with nearly a dozen...

Sensitive Information Leak

Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...