Serv-U FTP Server 15.1.7 - Local Privilege Escalation (1)

Serv-U FTP Server 15.1.7 - Local Privilege Escalation 1 / CVE-2019-12181 Serv-U 15.1.6 Privilege Escalation vulnerability found by: Guy Levin @vastart - twitter.com/vastart https://blog.vastart.dev to compile and run: gcc servu-pe-cve-2019-12181.c -o pe && ./pe / include include include int main...

A week in security (June 10 – 16)

Last week on Malwarebytes Labs, we revealed to readers the mindset of security pros as to why they lack confidence in their ability to prevent their organizations getting breached. We also reported on Maine Governor Janet Mills implementing the state’s own privacy protections, how Apple can bette...

Trolls abuse Twitter Lists to collate their targets

I’ve been using Twitter for more than a decade. And one of its features that I find valuable is Lists. Turns out I'm not the only one. Lists allow Twitter users to group profiles or feeds based on certain criteria, such as sports, tech news, celebrities, fashion—you get the idea. Having Lists mak...

Jigsaw Bought a Russian Twitter Troll Campaign as an Experiment

In a controversial move, the Alphabet-owned tech firm played both sides of an online argument in Russia with the aim of testing disinformation-for-hire services...

Internet Bug Bounty: Industry-Wide MITM Vulnerability Impacting the JVM Ecosystem

I've been exploring the industry-wide scope of the use of HTTP to resolve dependencies in build infrastructure across the industry. What I unearthed was that some of the most popular libraries and two compilers were impacted by this vulnerability. Vulnerability CWE-829: Inclusion of Functionality...

Probably?

Remy Sharp asked a question on Twitter that got me thinking about probability for the first time in a while. The problem Get your copybooks out now! Remy is using an image service that has an API which returns a URL for one of its images, picked at random. Remy makes five requests to the service,...

Amitabh Bachchan’s Twitter hacked with photo of Pakistani PM Imran Khan

By Uzair Amir Turkish hackers left a message protesting against Ireland on a Twitter account owned by India actor. The official Twitter account of Bollywood's legend Amitabh Bachchan has apparently been hacked by Turkish hacking group calling itself "Ayyildiz Tim." The verified Twitter account wi...

Malwarebytes Labs wins best cybersecurity vendor blog at InfoSec’s European Security Blogger Awards

Infosec Europe is now well underway, and last night was the annual EU Security Blogger Awards, where InfoSecurity Magazine: …recognises the best blogs in the industry as first nominated by peers and then judged by a panel of mostly respected industry experts. Malwarebytes Labs was announced as...

Twitter Contest! Enter to Win a $250 Gift Card at #CBConnect19

To make CB Connect 2019 even more exciting, we’re hosting a Twitter contest to see who can rack up the most engagement on Twitter. If you want to participate, just share your thoughts about CB Connect 2019 on Twitter by telling us what you’ve learned, which sessions you liked most, who you got to...

Exploit for Use After Free in Microsoft

Bluekeep PoC This repo contains research concerning CVE-2019-...

X (Formerly Twitter): Potential pre-auth RCE on Twitter VPN

Hi, weOrange Tsai and Meh Chang are the security research team from DEVCORE. Recently, we are doing a research about SSL VPN security, and found several critical vulnerabilities on Pulse Secure SSL VPN! We have reported to vendor and patches have been released on 2019/4/25. Since that, we keep...

X (Formerly Twitter): cookie injection allow dos attack to periscope.tv

Description: i find in periscope.tv a parameter "createuser" allow to inject "loginissignup" cookie, when tested with crlf payload get response "HTTP/1.1 504 GATEWAYTIMEOUT" Link Vulnerable: https://www.periscope.tv/i/twitter/login?createuser=payload&csrf=yourcsrftoken Steps To Reproduce: 1. go t...

Threat Source newsletter (May 16)

Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We were packed with vulnerabilities this week. For starters, there’s Microsoft Patch Tuesday, which we’ll cover farther down. We al...

Twitter Leaks Apple iOS Users' Location Data to Ad Partner

Twitter has disclosed a security bug in its platform that it said inadvertently leaked iOS users’ location data. The Twitter for iOS bug leaked location data at the ZIP code or city level, according to the social media company’s announcement on Monday. Twitter stressed that it has fixed the bug,...

Cross site scripting

Multiple stored cross-site scripting XSS in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: 1 Title, 2 Favicon, 3 Meta Description, 4 Subscribe Form Name field label, Last name field label, Email...

ExtAnalysis - Browser Extension Analysis Framework

With ExtAnalysis you can : Download & Analyze Extensions From: Chrome Web Store Firefox Addons Analyze Installed Extensions of: Google Chrome Mozilla Firefox Opera Browser Coming Soon Upload and Scan Extensions. Supported formats: .crx .xpi .zip Features of ExtAnalysis : View Basic Informations:...

X (Formerly Twitter): Verify any unused email address

Summary: Verify any unused email address in twitter account Description: After signing up on twitter it's recommended for a user to verify his/her email address to avoid spam and impersonation, I was able to verify the email without having access to the email itself. Steps To Reproduce: It's a bi...

X (Formerly Twitter): Reports Modal in app.mopub.com Disclose by any user

Summary: I sent this report and closed it "Informative" and asked me to send a new report if more information was available for exploitation 544278 Description: Twitter allows "mopub" users to create reports, and each report gives a unique ID to reach it, The report information is displayed by...

CVE-2019-5431

This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter"...

CVE-2019-5431

This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter"...