Snapchat: Subdomain takeover on http://fastly.sc-cdn.net/

Hey team, I've found a snapchat cdn domain here which had a test instance of fastly setup but did not remove the dns record when the service was cancelled. This allowed me to create a Fastly instance to take it over. I've confirmed this is a snapchat property via Censys...

Forwarding Loop Attacks in Content Delivery Networks may result in denial of service

Overview Content Delivery Networks CDNs may in some scenarios be manipulated into a forwarding loop, which consumes server resources and causes a denial of service DoS on the network. Description CWE-400: Uncontrolled Resource Consumption 'Resource Exhaustion' Content Delivery Networks CDNs are...

Redirecting On the Edge

On the web, every second counts. Service engineers and operations teams are looking for ways to save milliseconds from web pages' load times. One of the simpler ways to squeeze better performance from web pages already using a Content Delivery Network CDN is to move the redirection responses from...

Vuvuzela - Private Messaging System That Hides Metadata

Vuvuzela is a messaging system that protects the privacy of message contents and message metadata. Users communicating through Vuvuzela do not reveal who they are talking to, even in the presence of powerful nation-state adversaries. Our SOSP 2015 paper explains the system, its threat model,...

PageFair Hack Serves Up Fake Flash Update to 500 Sites

More than 500 users of a free analytics service may have had their websites compromised over the weekend after a hacker was able to execute malicious JavaScript through the service. On Halloween night, an attacker was able to hijack a “key email account” at PageFair, an ad blocking analytics...

jsDelivr: Pretty Photo Dom XSS

Hi Team, Javascript for http://www.jsdelivr.com/!prettyphoto hosted on the website points to 3.1.5 which is vulnerable to DOMXSS the upstream released an update 3.1.6 7 days back still the CDN is serving vulnerable edition effectively making all the websites vulnerable to DoMXSS Details about the...

IIS the latest high-risk Vulnerability, CVE-2 0 1 5-1 6 3 5, AND MS15-0 3 4. THE POC and online detection of source-vulnerability warning-the black bar safety net

! HTTP. sys remote code execution vulnerability, CVE-2 0 1 5-1 6 3 5, AND MS15-0 3 4. the A remote code execution vulnerability exists in the HTTP Protocol stack HTTP.sys, when the HTTP.sys not correct parsing specially crafted HTTP request to cause this vulnerability. Successful exploitation of...

HTTPS Opens Door to Paid Pinterest Bug Bounty

Pinterest’s journey toward becoming a fully HTTPS website opened a lot of doors, including a potentially profitable one for hackers. The social networking site this week announced that it would begin paying cash rewards through its bug bounty program, upping the stakes from the T-shirt it...

Lax Crossdomain Policy Puts Yahoo Mail At Risk

Yahoo has made strides in battening down its security in the last 12 months, most publicly with its decision to enable end-to-end encryption for its email service, turn on SSL by default, and encrypt links between its data centers. There are still some darkened corners of its infrastructure,...

HttpCombiner ASP.NET - Remote File Disclosure Vulnerability

Exploit for asp platform in category web applications Exploit Title: HttpCombiner ASP.NET Remote File Disclosure Vulnerability Google Dork: filetype:txt intext:HttpCombiner.ashx Date: 2014-10-10 Exploit Author: Hoang Anh Thai Vendor Homepage:...

Second jQuery Hack of Week Reported

Update A day after a compromise of the jQuery website was disclosed, the open source JavaScript library is dealing with a second attack. JQuery Foundation board member Ralph Whitbeck confirmed via email to Threatpost that a new compromise was under way and the organization was taking steps to...

A method can ignore the CDN to find the true IP DDOS and intrusion-vulnerability warning-the black bar safety net

This vulnerability,==should not count the vulnerability. But the impact of range is great, the current acceleration music, website defender, Baidu cloud acceleration, security, treasure, etc the CDN can beat the exhilaration of, a variety of high - DDOSand CC Defense, but this hole can ignore the...

Critical vulnerability in Twitter allows attacker to upload Unrestricted Files

Security expert Ebrahim Hegazy, Cyber Security Analyst Consultant at Q-CERT, has found a serious vulnerability in Twitter that allows an attacker to upload files of any extension including PHP. When an application does not validate or improperly validates file types before uploading files to the...

CVE-2012-1645

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php...

Code injection

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php...

CVE-2012-1645

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php...

CVE-2012-1645

The Drupal CDN module (versions 6.x-2.2 and 7.x-2.2) is affected when used in Origin Pull mode with the Far Future expiration option. The vulnerability allows remote attackers to read arbitrary PHP files from the site (demonstrated by reading settings.php) via unspecified vectors, due to how the ...

CVE-2012-1645: Exposure of Sensitive Information to an Unauthorized Actor

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php...

CVE-2012-2917

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...