Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 6.13.18 6.14.0 ≤ version 7.4....

WordPress < 5.5.2 - Cross-Site Request Forgery (CSRF) to Change Theme Background

Description Erwan, a security researcher from the WPScan team, discovered and responsibly disclosed a Cross-Site Request Forgery CSRF vulnerability that could allow an unauthenticated attacker to change the background image of the theme. For a successful attack, a privileged authenticated WordPre...

Did a Security Researcher Guess Trump’s Twitter Password?

Plus: An Among Us spam attack, China’s favorite vulnerabilities, and more of the week’s top security news...

The Now-Defunct Firms Behind 8chan, QAnon

Some of the worlds largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan. But according to a California-based security researcher, those seeking to de-platform these communities may have...

New Chrome 0-day Under Active Attacks – Update Your Browser Now

Attention readers, if you are using Google Chrome browser on your Windows, Mac, or Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today. Google released Chrome version 86.0.4240.111 today to patch several security...

Loginizer < 1.6.4 - Unauthenticated SQL Injection

The Loginizer WordPress plugin was found to be affected by an Unauthenticated SQL Injection vulnerability found by the security researcher mslavco. The vulnerability was triggered within the brute force protection functionality, which was enabled by default when the plugin was first installed. Wh...

Google’s Waze Can Allow Hackers to Identify and Track Users

A security researcher has discovered a vulnerability in Google’s Waze app that can allow hackers to identify people using the popular navigation app and track them by their location. Security DevOps engineer Peter Gasper discovered an API flaw in the navigation software that allowed him to track...

Exploit for Code Injection in Nette Application

CVE-2020-15227 ============== DISCLAIMER! I take no responsibil...

Exploitability Analysis: Smash the Ref Bug Class

In April 2020, security researcher Gil Dabah published a paper on a set of vulnerabilities he had discovered within the Win32k subsystem of the Windows operating system. These vulnerabilities demonstrated instances of a new class of bugs, dubbed “Smash the Ref.” Dabah’s research included 13 test...

Help Net Security – ThreadFix 3.0 Review

Help Net Security recently published a review of ThreadFix 3.0. Security Researcher, Toni Grzinic, took a deep dive into our vulnerability management platform and broke down everything from infrastructure, reporting and analytics, to integrations, and beyond. Click here to read Tonis full review ...

Visma Public: Bypassing Business ID/VAT # validation during registration to create accounts with duplicate Business ID/VAT #

The security researcher was able to bypass the Business ID/VAT validation that is required during registration. By doing this he was able to create accounts with duplicate Business ID/VAT...

Safari Bug Revealed After Apple Takes Nearly a Year to Patch

A security researcher disclosed details of an Apple Safari web browser security hole that could leak files with other browsers and applications and open the door to exploitation by attackers. The disclosure came only after Apple said it would delay patching the vulnerability for nearly a year. Fo...

Google vulnerability allowed sending spoofed emails with Gmail ID

By Sudais Asif Google fixed the vulnerability after the security researcher ended up disclosing its technical details online. This is a post from HackRead.com Read the original post: Google vulnerability allowed sending spoofed emails with Gmail ID...

akitech.vn Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1259193 Security Researcher geeknik Helped patch 8957 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting akitech.vn website and its...

kareplusmailer.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1256309 Security Researcher xav0 Helped patch 804 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting kareplusmailer.co.uk website and its users. Following...

cloudnra-fra-emea.net.nokia.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1241156 Security Researcher MaxP0wer666 Helped patch 0 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting cloudnra-fra-emea.net.nokia.com website and its users. Following coordinated and responsible vulnerability disclosure...

ktronix.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1236449 Security Researcher foreverunc Helped patch 49 vulnerabilities Received 3 Coordinated Disclosure badges Received 2 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ktronix.com website and it...

berylo.eu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1232442 Security Researcher xav0 Helped patch 640 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting berylo.eu website and its users. Following coordinated and...

digitalschnitt.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1225447 Security Researcher raz0rbl4de Helped patch 44 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting digitalschnitt.de website and its users. Following...

klemm-music.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1224385 Security Researcher raz0rbl4de Helped patch 44 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting klemm-music.de website and its users. Following...