invest.mp.gov.in Cross Site Scripting vulnerability OBB-2696236

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Improper Restriction of XML External Entity Reference in Zohocorp Manageengine_Adaudit_Plus

CVE-2022-28219 POC for CVE-2022-28219 affecting ManageEngine A...

A Bootiful Podcast: JVM and .NET legend Ted Neward on... just about everything

Hi, Spring fans! In this installment, I @starbuxman talk to my old friend, world-famous polyglot and code curmudgeon, software philosopher, industry veteran, and legend of ecosystems aplenty, Ted Neward @tedneward...

Malicious code in twitter-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62fd69dea005c32e68ba37d4f4c9aeb647e9ad8bf391f1474fc965712a4b8be0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6707 Malicious code in twitter-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62fd69dea005c32e68ba37d4f4c9aeb647e9ad8bf391f1474fc965712a4b8be0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6708 Malicious code in twitter-webhook-boilerplate-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4c54edfa90310f933c9c48f23b3e0d63b678c99863e73ed61a71cfbc0cea32e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twitter-webhook-boilerplate-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4c54edfa90310f933c9c48f23b3e0d63b678c99863e73ed61a71cfbc0cea32e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Panther Labs: Twitter Account hijack through broken link in https://runpanther.io

Summary: A linkhttps://twitter.com/runpanther in https://runpanther.io was broken and anyone could create that account which leads to account impersonate Steps To Reproduce: 1.Go to https://runpanther.io 2.Scroll down to bottom there you can see that twitter icon. 3.Click on that icon, you will...

The Tricky Business of Elon Musk Getting Twitter Fire-Hose Access

Twitter has reportedly given the billionaire access to its full stream of tweets and related user data. Is your privacy in jeopardy?...

Twitter Used Two-Factor Login Details for Ad Targeting

Twitter was fined $150 million for using phone numbers and email addresses collected for two-factor authentication for ad targeting...

cr.lsgkerala.gov.in Cross Site Scripting vulnerability OBB-2643656

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

petropolis.rj.gov.br Cross Site Scripting vulnerability OBB-2643641

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Awful 4chan chat bot spouts racial slurs and antisemitic abuse

“A robot may not injure a human being or, through inaction, allow a human being to come to harm” Science fiction readers, and many others, will recognize Asimov’s first law of robotics. After reading about a bot called GPT-4chan I was wondering whether we should include: “A bot may not insult a...

Socialhunter - Crawls The Website And Finds Broken Social Media Links That Can Be Hijacked

Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attacks. It also can cost a loss of the company's reputation. Broken social media hijack issues are usually accepted on the bug bounty programs. Currently, ...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

Exploit for CVE-2022-26134: Confluence Pre-Auth Remote Code Ex...

detran.ac.gov.br Cross Site Scripting vulnerability OBB-2636271

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Microweber CMS 1.2.15 - Account Takeover Vulnerability

Exploit Title: Microweber CMS 1.2.15 - Account Takeover Exploit Author: Manojkumar J Vendor Homepage: https://github.com/microweber/microweber Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15 Version: =1.2.15 Tested on: Windows10 CVE : CVE-2022-1631 Description:...

DuckDuckGo Isn’t as Private as You Think

Plus: A $150 million Twitter fine, a massive leak from a Chinese prison in Xinjiang, and an ISIS plot to assassinate George W. Bush...

Twitter Fined $150 Million for Misusing Users' Data for Advertising Without Consent

Twitter, which is in the process of being acquired by Tesla CEO Elon Musk, has agreed to pay $150 million to the U.S. Federal Trade Commission FTC to settle allegations that it abused non-public information collected for security purposes to serve targeted ads. In addition to the monetary penalty...

GHSA-X2CX-H7W4-Q6X7 Jenkins Twitter Plugin stores credentials in plain text

Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix...