JFrog: Impersonation attack via Broken link in "blog-author" page

A social media platform link of "Twitter" on https://jfrog.com/blog-author/john-peterson/ was broken and could've allowed a user to impersonate a reseller and attack / scam your customers. This happened because the account of twitter either deleted or changed their username. I thought I'd report ...

Indian PM Modi’s Twitter Account HACKED for Bitcoin scam

By Deeba Ahmed This was the second time that a Twitter account linked to PM Modi got compromised for a Bitcoin-related scam. This is a post from HackRead.com Read the original post: Indian PM Modis Twitter Account HACKED for Bitcoin scam...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j log4shell CVE-2021-44228 Public IoCs list Public IoCs...

X (Formerly Twitter): Link-shortener bypass (regression on fix for #1032610)

Report 1032610, entitled Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links was closed as Resolved about six months ago. However, a regression on the fix for the vulnerability in question seems to have occurred, and the bug is reproducible with the...

radiozet.pl Cross Site Scripting vulnerability OBB-2294844

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ThinkUp path traversal vulnerability

ThinkUp is a free, installable web application from ThinkUp USA, Inc. Used to gain insight into activity on social networks such as Twitter, Facebook and Instagram, ThinkUp has a security vulnerability that stems from the fact that ThinkUp 2.0-beta is affected by a path manipulation vulnerability...

Exploit for Path Traversal in Grafana

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All cre...

ThinkUp 路径遍历漏洞

ThinkUp is a free, installable web application from ThinkUp USA, Inc. Used to gain insight into activity on social networks such as Twitter, Facebook and Instagram, ThinkUp has a security vulnerability that stems from the fact that ThinkUp 2.0-beta is affected by a path manipulation vulnerability...

kupujemprodajem.com Cross Site Scripting vulnerability OBB-2290415

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| kupujemprodajem.com ---|--- Open Bug...

Twitter Bans Users From Posting 'Private Media' Without a Person's Consent

Twitter on Tuesday announced an expansion to its private information policy to include private media, effectively prohibiting the sharing of photos and videos without express permission from the individuals depicted in them with an aim to curb doxxing and harassment. "Beginning today, we will not...

procenter.ruready.nd.gov Cross Site Scripting vulnerability OBB-2288218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Code Security Advent Calendar 2021

We are happy to announce our sixth consecutive Code Security Advent Calendar! Born at RIPS in 2016, each calendar comprises 24 little code puzzles containing hidden security vulnerabilities that wait to be spotted. This is our way to share good vibes with the community while learning and having f...

All Vulnerabilities for cach.dhet.gov.za Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| cach.dhet.gov.za ---|--- Open Bug Bount...

Arrest in ‘Ransom Your Employer’ Email Scheme

In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employers network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the...

X (Formerly Twitter): Subdomain takeover of images.crossinstall.com

Summary images.crossinstall.com points to an AWS S3 bucket that no longer exists. I was able to take control of this bucket and put my own content onto it. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to anything...

sso.ucab.edu.ve Cross Site Scripting vulnerability OBB-2278012

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

eatout.co.im Cross Site Scripting vulnerability OBB-2277092

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild

No fewer than 1,220 Man-in-the-Middle MitM phishing websites have been discovered as targeting popular online services like Instagram, Google, PayPal, Apple, Twitter, and LinkedIn with the goal of hijacking users' credentials and carrying out further follow-on attacks. The findings come from a ne...

novel.nysed.gov Cross Site Scripting vulnerability OBB-2269985

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Not Punny: Angling Direct Breach Cripples Retailer for Days

The U.K.’s largest fishing retailer, Angling Direct, experienced a system breach on Nov. 5 that resulted in their domain being redirected to Pornhub. The jokes almost wrote themselves, but days later the site is still down and the extent of the damage to the company’s bottom line is remains uncle...