miamilakes-fl.gov Cross Site Scripting vulnerability OBB-1989901

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| miamilakes-fl.gov ---|--- Open Bug Boun...

mirassoldoeste.mt.gov.br Cross Site Scripting vulnerability OBB-1989458

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| mirassoldoeste.mt.gov.br ---|--- Open B...

Cybersecurity Experts to Follow on Twitter

Security Boulevard recently listed the "Top-21 Cybersecurity Experts You Must Follow on Twitter in 2021." I came in at 7. I thought that was pretty good, especially since I never tweet. My Twitter feed just mirrors my blog. If you are one of the 134K people who read me from Twitter, "hi."...

Exploit for Server-Side Request Forgery in Vmware Cloud_Foundation

VMWare-CVE-2021-21975 VMWare-CVE-2021-21975 SSRF vulnerabil...

Russia May Have Found a New Way to Censor the Internet

In an attempt to silence Twitter, the Kremlin appears to have developed novel techniques to restrict online content...

Beers with Talos Ep. #102: Twitter has questions for us

Beers with Talos BWT Podcast episode No. 102 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded Feb. 23, 2021 We’ve been... This is only the...

Fake Trezor app steals more than $1 million worth of crypto coins

Several users of Trezor, a small hardware device that acts as a cryptocurrency wallet, have been duped by a fake app with the same name. The app was available on Google Play and Apple’s App Store and also claimed to be from SatoshiLabs, the creators of Trezor. According to the Washington Post, th...

Scylla - The Simplistic Information Gathering Engine | Find Advanced Information On A Username, Website, Phone Number, Etc...

Scylla is an OSINT tool developed in Python 3.6. Scylla lets users perform advanced searches on Instagram & Twitter accounts, websites/webservers, phone numbers, and names. Scylla also allows users to find all social media profiles main platforms assigned to a certain username. In continuation,...

X (Formerly Twitter): Bypass t.co link shortener in Twitter direct messages

The researcher demonstrated a way to create a link that will not be replaced with safe shortened t.co url, by sending Direct Messages containing more than 50 t.co links to another Twitter user. If the recipient views the message using Twitter’s Android app, and clicks the 51st link in the...

A child sent out gibberish tweet from official US Nuclear-agency account

By Deeba Ahmed A Child’s Gibberish Tweet from US Nuclear-agency Account Sends Twitter into Frenzy - Sparks Debates on National Security. This is a post from HackRead.com Read the original post: A child sent out gibberish tweet from official US Nuclear-agency account...

niceincontact.com Cross Site Scripting vulnerability OBB-1969970

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| niceincontact.com ---|--- Open Bug Boun...

GHSA-P6P8-Q4PJ-F74M Improper Certificate Validation in twitter-stream

In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

Improper Certificate Validation in twitter-stream

In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

Improper Certificate Validation in twitter-stream

In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

ceskatelevize.cz Cross Site Scripting vulnerability OBB-1967838

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| ceskatelevize.cz ---|--- Open Bug Bount...

securityboulevard.com Cross Site Scripting vulnerability OBB-1967348

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| securityboulevard.com ---|--- Open Bug...

Development Kamel KCFinder 1.7 Shell Upload

Exploit Title : Development Kamel - KCFinder Shell Upload Vulnerability + Date : 25/03/2021 + Exploit Author : RAYAN ALi + Home : http://kamel.tech/ + Discovered By : RAYAN + Vendor Homepage : http://kamel.tech/ + Exploit: + http://localhost/resources/admin/Editor/kcfinder/browse.php?type=files +...

A week in security (March 15 – 21)

Last week on Malwarebytes Labs, our podcast featured Adam Kujawa, who talked us through our 2021 State of Malware report. We cover our own research on: Royal mail parcel scam How your iPhone can tell you if you’re being stalked Careers in cybersecurity ProxyLogon PoC whack-a-mole Teen behind 2020...

CopperStealer Malware Targets Facebook and Instagram Business Accounts

A malware that until now has gone undocumented has been quietly hijacking online accounts of advertisers and users of Facebook, Apple, Amazon, Google and other web giants since July 2019 and then using them for nefarious activity, researchers have found. Dubbed CopperStealer, the malware acts...

Security Researcher Hides ZIP, MP3 Files Inside PNG Files on Twitter

A security researcher has discovered a novel steganography technique for hiding data inside a Portable Network Graphics .PNG image file posted on Twitter, a tactic that could be exploited by threat actors to hide malicious activity. Researcher David Buchanan heralded his discovery on Twitter...