Booking a Taxi for Faketoken

The Trojan-Banker.AndroidOS.Faketoken malware has been known about for already more than a year. Throughout the time of its existence, it has worked its way up from a primitive Trojan intercepting mTAN codes to an encrypter. The authors of its newer modifications continue to upgrade the malware,...

CVE-2017-12068

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...

Uber: IDOR in activateFuelCard id allows bulk lookup of driver uuids

Due to an IDOR in the activateFuelCard endpoint, an attacker could enumerate driver UUIDs. When given a sequential card ID number, the endpoint returned a driver’s UUID given, allowing an attacker to gather many driver UUIDs for use in a different attack. Thanks, @cablej!...

Linux kernel information disclosure vulnerability (CNVD-2017-06927)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. An information disclosure vulnerability exists in the 'edgebulkincallback' function in the drivers/usb/serial/ioti.c file in Linux kernel versions 4.10.4 and earlier. A local...

Telecom's Campus Network Common Management Platform Has Overstepping Vulnerabilities

Telecom Campus Network Common Management Platform is a set of telecom campus network of China Telecom Group Corporation serving colleges and universities. An override vulnerability exists in the Telecom Campus Network Common Management Platform. The system fails to correctly verify user privilege...

Qualys Cloud Platform 2.26 New Features

This release of the Qualys Cloud Platform version 2.26 includes updates and new features for Cloud Agent, AssetView, Security Assessment Questionnaire and Web Application Scanning as follows: Highlights Cloud Agent Platform View Module Activation Job Status – adds a button in Agent Management tab...

XenMobile Rest API

XenMobile provides an extensive REST API that can be leveraged to extract data and provide it for business needs. This feature provides customers with the facility of calling XenMobile services using REST API. Instead of using XenMobile console, customers can call exposed services by using any RE...

Sendroid 5.2 - SQL Injection

Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225 Demo:...

Fome SMS Portal 2.0 SQL Injection

Exploit Title: Fome SMS Portal Advanced - Bulk SMS Reseller v2.0 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy: https://codecanyon.net/item/fome-sms-portal-advanced-bulk-sms-reseller-script/14241587 Demo:...

Sendroid 5.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy:...

XMS is unable to connect to DEP - Error: "Connection failed" when testing the connection

In the XMS console, inside iOS Bulk Enrollment DEP Configuration, when importing the Token file from the DEP Portal, the connectivity test is failing with error "Connection Failed". However, XMS connectivity tests are showing that XMS is able to reach Apple's websites, the ports are correctly...

Shopify: Open redirect in bulk edit

Hi , I have found an open redirection issue when bulk editing resources. PoC: Go to https://.myshopify.com/admin/bulk?resourcename=Product&returnto=/..//evil.com then click the Close button and you'll go to evil.com Thanks!...

Cybozu Mailwise contains issue in preventing clickjacking attacks

Overview Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the...

JVN#04125292: Cybozu Mailwise contains issue in preventing clickjacking attacks

Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Impact If a user views a malicious page while logged in, the user may be tricked into conducting unintended operations. Solution Update the Software Update to...

WordPress Bulk Delete Plugin 5.5.3 - 提权

No description provided by source...

WordPress Plugin Bulk Delete 5.5.3 - Privilege Escalation

WordPress Plugin Bulk Delete 5.5.3 - Privilege Escalation ''' Exploit Title: WordPress Bulk Delete Plugin Privilege Escalation Discovery Date: 2016-02-10 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://bulkwp.com/ Software Link:...

WordPress Bulk Delete 5.5.3 Plugin - Privilege Escalation Exploit

Exploit for php platform in category web applications ''' Exploit Title: WordPress Bulk Delete Plugin Privilege Escalation Discovery Date: 2016-02-10 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://bulkwp.com/ Software Link:...

WordPress Plugin Bulk Delete 5.5.3 - Privilege Escalation

''' Exploit Title: WordPress Bulk Delete Plugin Privilege Escalation Discovery Date: 2016-02-10 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://bulkwp.com/ Software Link: https://wordpress.org/plugins/bulk-delete/ Version: 5.5.3 Tested on:...

WordPress Bulk Delete 5.5.3 Privilege Escalation

Exploit Title: Bulk Delete Privilege Escalation Discovery Date: 2016-02-10 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://bulkwp.com/ Software Link: https://wordpress.org/plugins/bulk-delete/ Version: 5.5.3 Tested on: WordPress 4.4.2...

WordPress Bulk Delete Plugin 5.5.3 - Privilege Escalation

Because of this vulnerability, an attacker can perform all administrative tasks, such as delete all pages by status, delete all posts by type or delete all users. Solution Update the plugin...