IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF

The plugin does not have CSRF check in the ip2locationcountryblockersaverules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend. PoC Make an admin open a page with the following code in it,...

Happy 12th Birthday, KrebsOnSecurity.com!

KrebsOnSecurity.com celebrates its 12th anniversary today! Maybe "celebrate" is too indelicate a word for a year wracked by the global pandemics of COVID-19 and ransomware. Especially since stories about both have helped to grow the audience here tremendously in 2021. But this sites birthday also...

How to Prevent Customer Support Help Desk Fraud Using VPN and Other Tools

It's no secret that the internet isn't a very safe place. And it's not hard to understand why. It's a medium that connects billions of people around the world that affords bad actors enough anonymity to wreak havoc without getting caught. It's almost as if the internet's tailor-made to enable sca...

Microsoft Internet Explorer / ActiveX Control - Security Bypass Vulnerability

Exploit Title: Microsoft Internet Explorer / ActiveX Control - Security Bypass Exploit Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-ACTIVEX-CONTROL-SECURITY-BYPASS.txt twitter.com/hyp3rlinx ISR:...

Microsoft Internet Explorer / ActiveX Control - Security Bypass

Exploit Title: Microsoft Internet Explorer / ActiveX Control - Security Bypass Exploit Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-ACTIVEX-CONTROL-SECURITY-BYPASS.txt twitter.com/hyp3rlinx ISR:...

Microsoft Internet Explorer Active-X Control Security Bypass

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-ACTIVEX-CONTROL-SECURITY-BYPASS.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.microsoft.com Product Microsoft Internet Explorer MSIE...

Microsoft Internet Explorer Active-X Control Security Bypass Vulnerability

Microsoft Internet Explorer suffers from an active-x related bypass vulnerability. Microsoft will not address the issue as it is end of life. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Mozilla Firefox Security Advisory (MFSA2014-29) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Ad-blocker Chrome extension AllBlock injected ads in Google searches

By Deeba Ahmed AllBlock was available on Google Chrome's Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups. This is a post from HackRead.com Read the original post: Ad-blocker Chrome extension AllBlock injected ads in Google searches...

WordPress Ad Blocker Notify Lite plugin <= 2.4.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Ad Blocker Notify Lite plugin versions = 2.4.0. Solution 2021-08-25 - no patched version is available. Deactivate and delete...

CVE-2021-36126

An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a...

The 6 best Chrome extensions for privacy and security

While searching for security- and privacy-improving extensions, users may end up installing an extension that is counterproductive to their goals. To help our readers I have compiled a list of Chrome extensions that can actually help you improve your online privacy and security. Our regular reade...

DEBIAN-CVE-2021-30533

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe...

UBUNTU-CVE-2021-30533

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe...

Nextcloud: Bypass of privacy filter / tracking pixel blocker

Description ------------ When the mail app receives inline images, it will block them for privacy reasons to prevent tracking pixels The images have been blocked to protect your privacy. This block works correctly for most remote resources in addition to images, remote CSS files, iframes, and som...

Opera Browser for Android

Research Opera Browser for Android Share May 21st, 2021 In this episode of theOpera Bug Bounty series, we introduce Opera for Android, our main product for the Android platform. What is Opera for Android Opera for Android is a Chromium-based browser that prides itself on a user-friendly and good...

CVE-2021-29448

Pi-hole exposes a Stored XSS vulnerability in the Admin portal (Web Interface) of Pi-hole, described across multiple sources. The issue is a stored DOM/XSS flaw in the AdminLTE-based interface that can be triggered by an attacker with network access to the DNS server. Affected is Pi-hole’s admin/...

Basecamp: Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.

Summary: - Some Way Has Been Discovered To Bypass Image Rewriting On HeyMail Using Slashes Without Protocol /\www.evil.com That Allows Bypassing Tracking Blocker And Collect Users Information Via Emails. Description: - While Searching I Found That The Image Rewriting Function On Heymail Could Be...

21 Tips to Stay Secure, Private, and Productive as You Work from Home on Your Mac

Nowadays, Macs are part of the work-from-home workforce during the COVID-19 pandemic. If you’ve brought a Mac from the office to home, it’s likely your IT department has already set it up to meet your company’s security policies. But what if you’re enlisting a Mac already at home to do duty for...

openSUSE Security Update : opera (openSUSE-2020-402)

This update for opera fixes the following issues : Update to version 67.0.3575.97 - DNA-84063 Open URL in new tab with Go to web address in search/copy popup and right mouse click context menu - DNA-84780 Search in Search and Copy popup opens tab in wrong position from popup window - DNA-84786...