Practical advice for earning higher Microsoft bounty awards

This year at the Nullcon International Security Conference I shared practical advice for how security researchers can maximize the impact of their security vulnerability submissions and earn higher bounty awards under the Microsoft Bounty Program. For those who couldn’t be there, I had two core...

Imperva Wins Awards for Best Database Security, Coolest Cloud Security Vendor

SC Magazine has long been one of the most respected names in cybersecurity journalism, and one that has written about Imperva’s security research and solutions many times. So we’re proud to announce that we’ve won the 2019 SC Award for Best Database Security solution at SC’s awards ceremony on...

Carbon Black Wins Four 2019 Cybersecurity Excellence Awards

We’re excited to announce that the 2019 Cybersecurity Excellence Awards recognized Carbon Black as a winner of the following four categories: Best Cybersecurity Company Gold Winner Endpoint Security for Predictive Security Cloud Gold Winner Endpoint Detection and Response for CB ThreatHunter Silv...

Imperva Makes Major Expansion in Application Security

When Imperva announced in 2018 it would acquire the application security solution provider Prevoty, a company I co-founded with Julien Bellanger, I knew it would be a win-win for our industry. Prevoty’s flagship product, Autonomous Application Protection, is the most mature, market-tested runtime...

Carbon Black Named a Finalist in 2019 Cybersecurity Excellence Awards and SC Media Awards

Carbon Black has been a leader in endpoint security for years and, yet, we’re still extremely grateful for continued recognition in the industry. Most recently, Carbon Black is honored to be recognized as a finalist in four categories for the 2019 Cybersecurity Excellence Awards including: Best...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE:...

MyBB OUGC Awards 1.8.3 Cross Site Scripting

Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE: CVE-2019-3501 1. Description: OUGC Awards...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE: CVE-2019-3501 1. Description: OUGC Awards...

MyBB OUGC Awards Plugin Cross-Site Scripting Vulnerability

MyBB a.k.a. MyBulletinBoard is a free and web-based forum software developed by the MyBB team using PHP and MySQL.OUGC Awards plugin is used in one of the reward system plugins. A cross-site scripting vulnerability exists in versions of MyBB OUGC Awards plugin prior to version 1.8.19. A remote...

CVE-2019-3501

The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile...

Cross site scripting

The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile...

CVE-2019-3501

The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile...

CVE-2019-3501

The CVE-2019-3501 entry affects the MyBB OUGC Awards plugin (pre-1.8.19). A cross-site scripting vulnerability arises from unsanitized input for the award reason on the awards page and in user profiles, allowing crafted input to execute script when viewed. The issue is tied to the OUGC Awards plu...

CVE-2019-3501

The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile...

Code injection

The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUMTILES equals the number of people who purchased a tile, which allows an attacker to control the...

Akamai Takes Home Three Streaming Media Readers' Choice Awards

Streaming Media has announced its 2018 Readers' Choice Award winners at Streaming Media West in Huntington Beach, Calif. Recognizing technological excellence in the online video industry, Streaming Media readers cast more than 25,000 votes across 30 categories. Akamai was honored to win in three...

Bitfi research receives Pwnie Award for ‘lamest vendor response’

The Pwnie Awards is an annual celebration of the achievements of security researchers and the security community. It's also an opportunity to roast vendors for lame responses to security concerns. The ceremony took place last night, August 8th, 2018 in Las Vegas at the BlackHat USA security...

Zero-Day Coverage Update – Week of July 23, 2018

We’re at the end of July and the Zero Day Initiative ZDI has published 873 advisories so far. That’s 273 advisories this month alone – and that’s just the tip of the iceberg! Earlier this week, ZDI announced the Targeted Incentive Program, which brings over $1,500,000 USD in special bounty awards...

Recognizing Q4 Top 5 Bounty Hunters

We have tabulated the results from April-June 2018. The Top 5 Bounty Hunters for Q4 are now in. As with our list from Q3, we want to recognize both the leaders in payouts and in number of successful submissions. We appreciate the hard work and dedication of the following individuals and companies...