U.K. and U.S. Government Websites Among Thousands Infected by Cryptocurrency Miner

More than 4,200 websites, including many run the U.K. and U.S. governments, were infected on Feb. 11 by a Monero cryptocurrency miner delivered through Browsealoud, a hosted accessibility service that can read website content aloud for people with visual impairments. Browsealoud developer Texthel...

cdn.techterms.com XSS vulnerability

Open Bug Bounty ID: OBB-552082 Description| Value ---|--- Affected Website:| cdn.techterms.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

Do you believe in Serendipity?

In December 2016, after a month of mountain bike racing and touring in Nepal, I commenced the Executive Program in General Management at MIT. The first term was at Sloan School of Management in Cambridge and for the first time in my life, I finally could relate to studying. In fact, I was even...

Authentication flaw

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

CVE-2017-13761

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

CVE-2017-13761

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

CVE-2017-13761

The CVE-2017-13761 issue affects the Fastly CDN module for Magento 2 prior to 1.2.26. When this module is used with a third-party authentication plugin, remote authenticated users may obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses. Aff...

CVE-2017-13761

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

CVE-2017-13761: Exposure of Sensitive Information to an Unauthorized Actor

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses...

PT-2017-13081

Name of the Vulnerable Software and Affected Versions Fastly CDN module for Magento2 versions prior to 1.2.26 Description The issue allows remote authenticated users to obtain sensitive information from authenticated sessions. This is possible when the Fastly CDN module is used with a third-party...

Top-5 stupid security mistakes in web apps

by Ivan Novikov Image by Byseyhanla Own work CC BY-SA 4.0, article re-posted from In this blog entry, I will summarize some commonly overlooked issues which have been affecting many web projects for the last 5 years. All of them are obvious and super predictable and could be used be script kiddie...

Moderate: Red Hat Security Advisory: satellite and spacewalk security and bug fix update

An update for satellite-schema, spacewalk-backend, spacewalk-java, and spacewalk-schema is now available for Red Hat Satellite 5.8 and Red Hat Satellite 5.8 ELS. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base...

Incapsula Updated Review — New Security Options, Improved Delivery and Reliability

It's been close to five years since we last looked at Incapsula, a security-focused CDN service known for its DDoS mitigation and web application security features. As one would expect, during these five years the company has expanded and improved, introducing lots of new features and even severa...

cdn.accessmylogin.com XSS vulnerability

Vulnerable URL: http://cdn.accessmylogin.com/api/dynamic/4112/getItems.php?itemid=...

Shopify: Tinymce 2.4.0

Hello, The following url https://app.shopify.com//services/mobileapp/rte Loads https://cdn.shopify.com/s/assets/mobileapp/rte-bundle-f044a6c638b6c0500848c772dd5c86bf0eb2b27516c0860c6d3ddafde42231e2.js which is a minified tinymce 2.4.0. This version of tinymce has known vulnerabilities but in orde...

What’s new in Gartner WAF Magic Quadrant 2017?

To tell the truth, I was not much interested in Web Application Firewall market since the time when I was doing competitive analysis in Positive Technologies. And a few days ago Gartner published a fresh WAF research with interesting Magic Quadrants. I decided to figure out what's new there. Here...

cdn.na.sage.com XSS vulnerability

Vulnerable URL: http://cdn.na.sage.com/sagemail/SageHRMS/hrmstrainingcatalogue2014q4/bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnT1BFTiBCVUdCT1VOVFknKTwvc2NyaXB0Pg== Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.10.2017 Vulnerability...

cdn.discordapp.com XSS vulnerability

Vulnerable URL: https://cdn.discordapp.com/attachments/290938712114855938/337966295754473474/profilepc.svg Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

Unwelcome Interruptions

Imagine your player's first experience with your game. Finally, after waiting all these years, she's got the game in hand. She tears the cellophane, cracks the case, slots the disc, and . . . "Game is now updating. Please wait." Watching 20 GB load onto a machine is not anyone's idea of fun. I ha...

Cookie consent from silktide, Unknown version, Other

Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...