libipa_hbac, libsss_idmap, libsss_nss_idmap, libsss_simpleifp, python, sssd security update

CentOS Errata and Security Advisory CESA-2015:2355 Updated sssd packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability...

X (Formerly Twitter): Subdomain Expired

Vulnerable domain: mopub.com Vulnerable SUB-domain: http://tool.mopub.com your subdomain http://tool.mopub.com which is pointing to hosted-by.myinternetservices.com and service is expirted at myinternetservices.com Remove this entry otherwise attacker can use this one. thanks...

HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...

WePay: Subdomain Takeover in http://staging.wepay.com/ pointing to Fastly

Hi. One of your subdomain http://staging.wepay.com/ is vulnerable to subdomain takeover. Since if you visit the site, it will be saying "unknown domain" which indicates that there are no currently deployed services set up with the specified domain and attackers can copy that domain in any hosting...

eBay Fixes XSS Flaw in Subdomain

There was a cross-site scripting vulnerability in an eBay domain that could have allowed an attacker to steal users’ session cookies and take over their accounts. The company has removed the vulnerable page, according to the researcher who discovered the bug and disclosed it to eBay, Aditya Sood...

SubDomain Analyzer - Get detailed information of a domain

The "SubDomain Analyzer" tool written in Python language. The purpose of "SubDomain Analyzer" getting full detailed information of selected domain. The "SubDomain Analyzer" gets data from domain by following steps: 1. Trying to get the zone tranfer file. 2. Gathers all information from DNS record...

Salesforce Patches XSS on a Sub-Domain

Salesforce.com has patched a vulnerability on one of its subdomains that exposed users to account takeover, phishing attacks and the installation of malicious code. The vulnerability was disclosed yesterday by researcher Aditya K. Sood of Elastica Cloud Threat Labs. Sood said admin.salesforce.com...

Acunetix Web Vulnerability Scanner 9.5 - Crash PoC Exploit

Exploit for windows platform in category dos / poc !/usr/bin/env python Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept Website : https://www.acunetix.com Tested : win 7 / win 8.1 / win vista Author : Hadi Zomorodi Monavar Email : email protected 1 . run python code : pyth...

Acunetix Web Vulnerability Scanner 9.5 - Crash (PoC)

!/usr/bin/env python Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept Website : https://www.acunetix.com Tested : win 7 / win 8.1 / win vista Author : Hadi Zomorodi Monavar Email : [email protected] 1 . run python code : python poc.py 2 . open hadi.txt and copy content...

Nikto2 - Web Server Scanner

Nikto is an Open Source GPL web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks...

Heroku API - Re Auth Session Token Bypass Vulnerability

Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...

Heroku API - Re Auth Session Token Bypass Vulnerability

Document Title: =============== Heroku API - Re Auth Session Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1336 View: https://www.youtube.com/watch?v=1WpWVVXVUSs Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1323 Release Date:...

ALi CTF 2 0 1 5 write up-vulnerability warning-the black bar safety net

0x00 Cake Cake is a title of Android Title, The specific process is an input a string and then initialize a length of 1 by 6 Array, then the string with this array of xor. So we just need to xor it ok. Just look at the code in reverse, the key is there are two Key looking for ok direct codes a= 0...

CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

PT-2015-1039

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0 Description The issue allows an attacker controlling network traffic to bypass user authentication by deploying a specially crafted website and conducting a DNS spoofing attack against a mozilla.org...

Vimeo: URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io

Hi, Brief This is an urgent issue and I hope you will act on it likewise. Your subdomain status.vimeo.com is pointing to hosted.statuspage.io, but no statuspage was connected to it. This means that anyone can claim the subdomain by setting up a statuspage.io site and using "status.vimeo.com" as t...

SubBrute - Subdomain Bruteforcer

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting https://www.us-cert.gov/ncas/alerts/TA13-088A. This desig...

DNS Enumeration Script: DNSRecon

DNS reconnaissance is part of the information gathering stage on a penetration test engagement. When a penetration tester is performing a DNS reconnaissance he is trying to obtain as much information as he can regarding the DNS servers and their records. The information that can be gathered can...

Subdomain Enumeration Tool: SubBrute

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting /TA13-088A . This design also provides a layer of...