CVE-2017-11586

FineCMS 5.0.9 contains an open redirect vulnerability exploitable via the url parameter in a sync action, linked to controllers/Weixin.php. The NVD entry CVE-2017-11586 documents URL Redirector Abuse with CVSS 3.0 score 6.1 (NETWORK, PR:N, UI:R). Nuclei templates corroborate an open redirect cond...

PT-2017-12121

Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9 Description The issue concerns URL Redirector Abuse via the url parameter in a sync action, related to the controllers/Weixin.php file. Recommendations For dayrui FineCms version 5.0.9, consider restricting access ...

Free Certs Come With a Cost

Let’s Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100...

Cuvva: CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvva

Description : cuvva.co allows user to send app download link to his/her mobile number via SMS. But attacker can abuse this system via cross site request forgery and can send SMS to N number of mobile numbers without even visiting the cuvva.com/cuvva.insure website. Reproduction Steps :...

PT-2017-11950

Name of the Vulnerable Software and Affected Versions dataTaker DT8x dEX version 1.72.007 Description The issue allows remote attackers to compose programs or schedules. This can be used for various purposes, including sending e-mail messages or making outbound connections to FTP servers for...

phpMyFAQ Improper Restriction Vulnerability

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A security vulnerability exists in versions of...

Cross site scripting

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can...

CVE-2017-11195

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can...

Top-5 stupid security mistakes in web apps

In this blog entry, I will summarize some commonly overlooked issues which have been affecting many web projects for the last 5 years. All of them are obvious and super predictable and could be used be script kiddies as well as by fully automated scanners and internal security checks. Let’s go! 1...

Google Hit With $2.7 Billion Antitrust Fine

Search giant Google this week was hit with a hefty $2.7 billion fine seven years in the making. Antitrust officials with the European Commission handed out the fine, which translates to €2.4 billion. Regulators with the EC claim the company abused its dominance as a search engine to push its...

VulnCheck KEV: CVE-2003-0127

The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel...

External XML Entity (XXE) Attacks

python3-saml is vulnerable to external XML entity XXE attacks. These attacks are possible through the abuse of XML...

Abuse of Apple Search Ads Feature Leading to Fraud

Apple has removed one of its top 10 grossing productivity apps after an independent developer’s story about fraudsters’ abuse of the App Store’s Search Ads functionality went viral. Search Ads is a new feature available to iOS developers that allows them to invest in the promotion of their apps...

Can YOU spot the fake?

As we predicted in 2016, cyberpropaganda is a major growth area for cybercriminals. Per that prediction, “The rise in the Internet penetration has opened the opportunity for invested parties to use the Internet as a free-for-all tool to influence public opinion to go one way or another.” Today, w...

Google Releases reCAPTCHA API for Android

Google announced today that it has made a new reCAPTCHA API available for Android. The API is part of Google Play Services, Google said, and developers can now add the verification to mobile applications to distinguish between bots and human users. The technology is more than a decade old and...

Man Jailed 6 Months for Refusing to Give Police his iPhone Passcode

Remember Ramona Fricosu? A Colorado woman was ordered to unlock her encrypted Toshiba laptop while the FBI was investigating alleged mortgage fraud in 2012, but she declined to decrypt the laptop saying that she did not remember the password. Later the United States Court ruled that Police can...

Arbitrary Password Reset Vulnerability in Paco Drive Android App

BaGoDrive is an O2O online and offline taxi application based on LBS geographical location developed by Jiangsu Xunzhi Network Technology Co. There is an arbitrary password reset vulnerability in the BaGeDrivingTo Android app, which allows attackers to reset the password by using the other party'...

All Android Phones Vulnerable to Extremely Dangerous Full Device Takeover Attack

Researchers have discovered a new attack, dubbed 'Cloak and Dagger', that works against all versions of Android, up to version 7.1.2. Cloak and Dagger attack allows hackers to silently take full control of your device and steal private data, including keystrokes, chats, device PIN, online account...

CVE-2017-2801

A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate verification issues and abuse. A specially crafted X509 certificate would need to be delivered to the client or server application in order to...

High Performance DNS Stub Resolver: MassDNS

A high performance DNS stub resolver in C MassDNS is a simple high-performance DNS stub resolver targetting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 100,000,000 domains...