Fireware XTM Web UI Open Redirect

================================================================ Fireware XTM Web UI - Open Redirect ================================================================ Information -------------------- Name: Fireware XTM Web UI - Open Redirect Affected Software : Fireware XTM Web UI Affected Version...

Uber: Brute Force Amplification Attack

The websites on following hosts - newsroom.uber.com - eng.uber.com - brand.uber.com are vulnerable to Wordpress Brute Force Amplification Attack where an attacker can try a large number of Wordpress usernames and password login combinations in single HTTP request more at...

CVE-2016-1780

WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment via a crafted web site...

Anti-Malware Security & Brute-Force Firewall <= 4.15.42 - XSS & CSRF

The Anti-Malware Security and Brute-Force Firewall WordPress plugin was affected by a XSS & CSRF security vulnerability. XSS vulnerability in https://wordpress.org/plugins/gotmls/ has been identified. While I scan a site with that plugin , i had a file '".png and it was skippped , but result was...

Anti-Malware Security & Brute-Force Firewall <= 4.15.42 - XSS & CSRF

The Anti-Malware Security and Brute-Force Firewall WordPress plugin was affected by a XSS & CSRF security vulnerability. PoC XSS vulnerability in https://wordpress.org/plugins/gotmls/ has been identified. While I scan a site with that plugin , i had a file '".png and it was skippped , but result...

The vulnerability of the Moodle learning management system allows a hacker to redirect users to arbitrary websites.

The vulnerability of the cleanparam function in the Moodle learning management system’s library/moodlelib.php file is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites and carry out phishing attacks through actio...

Steam Stealer Malware "Booming Business" for Attackers Targeting Gaming Service

Malware that targets Steam accounts has proliferated the gaming platform and become what researchers are calling a “booming business” for cybercriminals over the last few months. The popular platform, owned by Valve, boasts 140 million users and is so ripe for attacks that according to the compan...

Adobe Flash Player: Multiple vulnerabilities

Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact A remote attacke...

[SECURITY] Fedora 22 Update: drupal7-7.43-1.fc22

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

More than 1 Million Websites Install Free SSL Certificate (and Counting...)

Let's Encrypt has achieved another big milestone by issuing 1 million free Transport Layer Security TLS SSL Certificates to webmasters who wish to secure the communications between their users and domains. Let's Encrypt – operated by the Internet Security Research Group ISRG – is an absolutely...

CTB-Locker/Critroni Finds New Legs Targeting Websites

After months of relative dormancy, ransomware CTB-Locker or Critroni is back and this time finding new life targeting websites. Researchers are calling this variant “CTB-Locker for Websites” because it targets websites, encrypts their content, and demands a 0.4 bitcoin $425 ransom for access to t...

openSUSE Security Update : Chromium (openSUSE-2016-238)

This update to Chromium 48.0.2564.109 fixes the following issues : Security fixes boo965999 : - CVE-2016-1622: Same-origin bypass in Extensions - CVE-2016-1623: Same-origin bypass in DOM - CVE-2016-1624: Buffer overflow in Brotli - CVE-2016-1625: Navigation bypass in Chrome Instant - CVE-2016-162...

Joomla Joins WordPress As TeslaCrypt Ransomware Target

Exploit kits infecting thousands of WordPress websites are setting their sights on the open-source content management system Joomla in a new campaign spotted by a researcher at the SANS Institute’s Internet Storm Center. “The group behind the WordPress ‘admedia’ campaign is now apparently targeti...

openSUSE Security Update : Chromium (openSUSE-2016-221)

This update to Chromium 48.0.2564.109 fixes the following issues : Security fixes boo965999 : - CVE-2016-1622: Same-origin bypass in Extensions - CVE-2016-1623: Same-origin bypass in DOM - CVE-2016-1624: Buffer overflow in Brotli - CVE-2016-1625: Navigation bypass in Chrome Instant - CVE-2016-162...

SSL VPN Split Tunnel Issue Through NetScaler

Split tunneling does not allow to access internal websites. When WorxWeb is launched "The VPN service has failed to connect" error message is displayed. With split tunneling disabled customer is able to view website fine traffic is routed to internal network. When trying to hit external network...

Deep Web Search Engines to Explore the Hidden Internet

Do you know: There is a vast section of the Internet which is hidden and not accessible through regular search engines and web browsers. This part of the Internet is known as the Deep Web, and it is about 500 times the size of the Web that we know. What is DEEP WEB? Deep Web is referred to the da...

WordPress Core Multiple Vulnerabilities (Feb 2016) - Linux

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

WordPress Clikstats 0.8 Open Redirect

Exploit Title : Wordpress clikstats plugin Open Redirect Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/clikstats/ Google Dork : inurl:"/wp-content/plugins/clikstats/ck.php?" Sofware Link: https://downloads.wordpress.org/plugin/clikstats.zip Date: ...

CVE-2016-1728

The Cascading Style Sheets CSS implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site...

Microsoft Edge browser vulnerability, allowing attackers to redirect users to arbitrary websites

The vulnerability of Microsoft Edge relates to the improper handling of HTTP responses. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites remotely...