HackerOne: Domain spoofing in redirect page using RTLO

Summary: Hello, Domains can be spoofed on redirect page using RTLO. Description Include Impact: Using http://[email protected] & RTLO method, i found a way where redirect page host detection can be spoofed Steps 1. Insert this on report Just Click Here 2. On click of link, it will redirect to...

Cells Blog 3.5 - bgid fmid fnid SQL Injection

Cells Blog 3.5 - bgid fmid fnid SQL Injection Exploit Title: Cells Blog 3.5 - SQL Injection Dork: N/A Date: 16.12.2017 Vendor Homepage: http://www.cells.tw/ Software Link: http://www.cells.tw/cells/ Version: 3.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Senc...

Threat Outbreak Alert RuleID31608: Email Messages Distributing Malicious Software on December 15, 2017

Medium Alert ID: 56274 First Published: 2017 December 15 15:04 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31608 may contain the following files: Name |...

Invoice – BizXpert - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Invoice – BizXpert published at the 'play' market has multiple vulnerabilities...

Design/Logic Flaw

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...

UBUNTU-CVE-2017-17520

DISPUTED tools/urlhandler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional...

CVE-2017-17527

delphigui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code...

openSUSE Security Update : fossil (openSUSE-2017-1365)

This update for fossil to version 2.4 fixes the following issues : - CVE-2017-17459: Client-side code execution via crafted 'ssh://' URLs bsc1071709 The impact of this vulnerability is more limited than similar vectors fixed in other SCMs, as there is no known way to mask the repository URL or...

Threat Outbreak Alert RuleID31622: Email Messages Distributing Malicious Software on December 13, 2017

Medium Alert ID: 56251 First Published: 2017 December 13 18:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31622 may contain the following files: Name |...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

المسافر لحجز الفنادق و الطيران - Exported components, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application المسافر لحجز الفنادق و الطيران published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID31589: Email Messages Distributing Malicious Software on December 11, 2017

Medium Alert ID: 56218 First Published: 2017 December 11 17:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31589 may contain the following files: Name |...

Threat Outbreak Alert RuleID31582: Email Messages Distributing Malicious Software on December 11, 2017

Medium Alert ID: 56216 First Published: 2017 December 11 17:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31582 may contain the following files: Name |...

Threat Outbreak Alert RuleID31554: Email Messages Distributing Malicious Software on December 6, 2017

Medium Alert ID: 56172 First Published: 2017 December 6 14:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31554 may contain the following files: Name |...

Threat Outbreak Alert RuleID31550: Email Messages Distributing Malicious Software on December 6, 2017

Medium Alert ID: 56171 First Published: 2017 December 6 14:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31550 may contain the following files: Name |...

Readymade Classifieds Script 1.0 - SQL Injection

Exploit Title: Readymade Classifieds Script 1.0 - SQL Injection Dork: N/A Date: 02.12.2017 Vendor Homepage: http://www.scubez.net/ Software Link: http://www.posty.in/index.html Demo: http://www.posty.in/readymade-classifieds-demo.html Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

USN-3477-3 firefox regressions

USN-3477-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafte...

Threat Outbreak Alert RuleID31456: Email Messages Distributing Malicious Software on December 1, 2017

Medium Alert ID: 56111 First Published: 2017 December 1 17:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31456 may contain the following files: Name |...

Threat Outbreak Alert RuleID31256: Email Messages Distributing Malicious Software on December 1, 2017

Medium Alert ID: 56110 First Published: 2017 December 1 17:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31256 may contain the following files: Name |...

Threat Outbreak Alert RuleID31190: Email Messages Distributing Malicious Software on December 1, 2017

Medium Alert ID: 56108 First Published: 2017 December 1 17:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31190 may contain the following files: Name |...