TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 22, 2018

Yesterday, the Zero Day Initiative ZDI announced the dates and contest rules for Pwn2Own 2018. Last year, we celebrated the 10th anniversary of the event and the 11th year is going to be bigger than ever! Pwn2Own will be returning to Vancouver, BC, at the CanSecWest Conference on March 14-16, 201...

FLARE IDA Pro Script Series: Simplifying Graphs in IDA

Introduction We’re proud to release a new plug-in for IDA Pro users – SimplifyGraph – to help automate creation of groups of nodes in the IDA’s disassembly graph view. Code and binaries are available from the FireEye GitHub repo. Prior to this release we submitted it in the 2017 Hex-Rays plugin...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 30, 2017

Competition is inherent in our DNA. At a basic level, we compete for things like water and food. We also take it up a level and compete for wealth, fame and power. Some compete to be the best in sports, like my Houston Astros winning the 2017 World Series, and others compete to be the best in the...

Keen IT Photo Contest, 1.0.2, SQL Injection

Keen IT Photo Contest, 1.0.2, SQL Injection...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Towards a Safer Internet for All: Winners of New Brunswick Video Contest Announced

Today more than ever, society needs to come together to work towards a better and safer future for all our children. This doesn’t just mean members of the public: companies can and should play a key role in helping to support worthy causes. Global citizenship and cyber security are two issues tha...

D-Link 850L XSS / Backdoor / Code Execution Vulnerabilities

D-Link 850L suffers from cross site scripting, access bypass, backdoor, bruteforcing, information disclosure, remote code execution, and denial of service vulnerabilities. Basically, do not use this device unless you want to analyze it to see how not to design something. Advisory Information Titl...

Joomla Photo Contest 1.0.2 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Photo Contest 1.0.2- SQL Injection Dork: N/A Date: 25.08.2017 Vendor Homepage: http://keenitsolution.com/ Software Link: https://codecanyon.net/item/photo-contest-joomla-extension/13268866 Demo:...

Joomla! Component Photo Contest 1.0.2 - SQL Injection

Exploit Title: Joomla! Component Photo Contest 1.0.2- SQL Injection Dork: N/A Date: 25.08.2017 Vendor Homepage: http://keenitsolution.com/ Software Link: https://codecanyon.net/item/photo-contest-joomla-extension/13268866 Demo: http://photo.keenitsolution.com/ Version: 1.0.2 Category: Webapps...

Joomla! Component Photo Contest 1.0.2 - SQL Injection

Joomla! Component Photo Contest 1.0.2 - SQL Injection Exploit Title: Joomla! Component Photo Contest 1.0.2- SQL Injection Dork: N/A Date: 25.08.2017 Vendor Homepage: http://keenitsolution.com/ Software Link: https://codecanyon.net/item/photo-contest-joomla-extension/13268866 Demo:...

Announcing the Fourth Annual Flare-On Challenge

The fourth annual Flare-On Challenge – the FireEye Labs Advanced Reverse Engineering FLARE team’s yearly reverse engineering contest – is scheduled to kick off on Sept. 1, 2017, at 8pm ET. This is a CTF-style challenge for all active and aspiring reverse engineers, malware analysts, and security...

Promoting Online Safety in Canada: Trend Micro Launches Video Contest for Local Kids

At Trend Micro we always strive to be a responsible corporate citizen. Right from the beginning the company has devoted significant time and resources to a variety of projects: from house building in the Philippines, to our Give and Match programs around the world designed to support vital...

Vmware virtual machine escape Vulnerability CVE-2017-4901）Exploit code analysis and use-vulnerability and early warning-the black bar safety net

0×01 event analysis 2017 7 on 19 unamer in its github released a for Vmware virtual machine escape exploit source code, using C++. The alleged impact of Vmware Workstation 12.5.5 the previous version, and gives a demonstration of the process, to achieve a from the virtual machine to the host...

Project Zero Prize Conclusion

Posted by Natalie Silvanovich, Project Zero On September 13, 2016 we announced the Project Zero Prize. It concluded last week with no prizes awarded. The purpose of this post is to discuss what happened and what we learned about hacking contest design. Throughout the contest, we did not receive a...

FTC Issues Public Challenge to Improve IoT Patching

Admittedly, patching existing connected devices in the wild is easier said than done. But that’s not deterring the Federal Trade Commission from soliciting help in finding a solution. The U.S. government agency today announced the kickoff of the FTC IoT Home Inspector Challenge, a prize contest...

Cross-site scripting vulnerability in wordpress plugin contest-gallery

Contest Gallery is a Wordpress plugin. The Wordpress plugin contest-gallery suffers from an xss vulnerability due to improper filtering of user input, which allows attackers to frame malicious web pages and trick users into parsing them to execute arbitrary code...

The Project Zero Contest — Google will Pay you $200,000 to Hack Android OS

Why waiting for researchers and bug hunters to know vulnerabilities in your products, when you can just throw a contest for that. Google has launched its own Android hacking contest with the first prize winner receiving $200,000 in cash. That's a Hefty Sum! The contest is a way to find and destro...

Announcing the Third Annual Flare-On Challenge

Let fall be the season for reverse engineering! On Sept. 23, 2016, the FireEye Labs Advanced Reverse Engineering FLARE team will be hosting its third annual Flare-On reverse engineering contest with a designated start time of 8pm ET. This is a CTF-style challenge for all active and aspiring rever...

Announcing the Project Zero Prize

Posted by Natalie Silvanovich, Exploit Enthusiast Despite the existence of vulnerability rewards programs at Google and other companies, many unique, high-quality security bugs have been discovered as a result of hacking contests. Hoping to continue the stream of great bugs, we’ve decided to star...

designcontest.com XSS vulnerability

Vulnerable URL: https://www.designcontest.com/"/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 46891 VIP website status:| Yes Check designcontest.com SSL connection:| Grade: B-...