Mail.ru: Cross application scripting via account.mail.ru

Crossapplication scripting via User-Agent on push login confirmation functionality in mobile application in the context of account.mail.ru domain allowed session hijacking with minimal user interaction...

Woo Confirmation Email < 3.2.0 - Missing Access Controls to View Uploaded files

The User Email Verification for WooCommerce WordPress plugin was affected by a Missing Access Controls to View Uploaded files security vulnerability...

The PCLOB Needs a Director

The US Privacy and Civil Liberties Oversight Board is looking for a director. Among other things, this board has some oversight role over the NSA. More precisely, it can examine what any executive-branch agency is doing about counterterrorism. So it can examine the program of TSA watchlists, NSA...

About the security content of iOS 11.4.1 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

ADM fails to upgrade ADC in HA -- DEVICE_NOT_REACHABLE

ADM logs:- Error Config8 https://x.x.x.x/nitro/v1/config/nshostname?format=json, Reason: Exception: DEVICENOTREACHABLE Debug Config8 NetScaler x.x..x.xStill rebooting.. Error Config8 DeviceRebootStatus: Reboot Failed for NS x.x.x.x This is how it would appea on ADM When you login to ADC we can...

QIWI: Возможность регистрации на сайте qiwi.com на любой номер телефона

Summary При регистрации на сайте qiwi.com присылается один и тот же код подтверждения в СМС. Impact Возможность зарегистрироваться под любым новым пользователем за счет перебора кода из СМС...

Valve: code injection, steam chat client

The steam chat client allows oEmbed, apparently based on a whitelist. One of the whitelisted oEmbedis codepen. When a codepen is created, it can be sent as a link to another steam user, and the code inside the codepen will execute within the privileged Steam Chat context. You can send these codep...

RHEL 6 : chromium-browser (RHSA-2018:2666)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2666 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 69.0.3497.81. Security Fixes:...

Debian DSA-4289-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...

biosync-beta.rutgers.edu XSS vulnerability

Open Bug Bounty ID: OBB-674342 Description| Value ---|--- Affected Website:| biosync-beta.rutgers.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 69 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 69.0.3497.81 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

KLA11312 Multiple vulnerabilities in Google Chrome

Multiple serious vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: 1. ...

meco-werkzeugbau.de XSS vulnerability

Open Bug Bounty ID: OBB-672659 Description| Value ---|--- Affected Website:| meco-werkzeugbau.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Weblate: 2nd issue>>> flood of email no rate limit on delete account confirmation email >>

There was no rate limit on delete account confirmation email, leading to user being able to send himself flood of emails...

fuckthathussy.com XSS vulnerability

Open Bug Bounty ID: OBB-671376 Description| Value ---|--- Affected Website:| fuckthathussy.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

2018 年 10 月 Office 365 で TLS 1.0, 1.1 での接続無効化。 最終確認を！

こんにちは、垣内ゆりかです。 マイクロソフトでは、Transport Layer Security TLS 1.0, 1.1 の利用を廃止し、より安全...

cPanel Filename Based Stored XSS < v76 Exploit

Usage Info Create a file as named with your payload in /home/user/logs directory or run the php exploit. + Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "...

cPanel 76 Cross Site Scripting

Title: cPanel Filename Based Stored XSS http://ip:2082/cpsessXXXXXXXXXX/frontend/THEME/raw/index.html '; else die'An error occured.'; else echo 'Enter your payload: " "'; // end of the script. ? Note: You cant create a file as named with / slash character by this exploit. This vulnerability is...

DEF CON 2018: Telltale URLs Leak PII to Dozens of Third Parties

LAS VEGAS – When we order food online, book a plane ticket or purchase seats for a show, we often get an email confirmation with a handy link that, when clicked, takes us directly to our confirmation, with no need to log back into the site. These pages have our confirmation code, the ability to...

Adventures in vulnerability reporting

Posted by Natalie Silvanovich, Project Zero At Project Zero, we spend a lot of time reporting security bugs to vendors. Most of the time, this is a fairly straightforward process, but we occasionally encounter challenges getting information about vulnerabilities into the hands of vendors. Since i...