Low-Cost Ransomware Service Discovered

A new ransomware as a service RaaS called Karmen has been discovered by security researchers at Recorded Future. This service allows anyone, including novices, to set up an account and customize their own ransomware campaign. The Karmen RaaS costs $175 and lets buyers set ransom prices, determine...

Hermosoft CMS Admin Page Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title : Hermosoft CMS Admin Page ByPass Exploit Author : xBADGIRL21 Dork: intext:Website Designed by Hermosoft, Dubai 2017. All rights reserved Tested on: Windows skype:xbadgirl21 Date: 11/04/2017 video Proof :...

dashboard.bentpixels.com XSS vulnerability

Vulnerable URL: https://dashboard.bentpixels.com/?rwg7w%3E%3Cscript%3Ealert%22openbugbounty%22%3C/script%3Es6pg1=1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...

Cross site scripting

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...

Faraday v2.4 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

Cross-site Scripting (XSS) Via Admin Dashboard

keystone is vulnerable to cross-site scripting XSS attacks. The user's input to the name field in the admin dashboard is not HTML escaped because the input is passed to JSON.stringify instead of doing proper serialization...

GitLab: Open redirect

POC: $GITLABINSTANCE = gitlab.com Visit: https://$GITLABINSTANCE/dashboard/todos?page=99999999&host=www.google.com Bug is in Dashboard::TodosController line 10 Likey Same bug in Projects::IssuesController line 32 and other places in the codebase where you redirectto params.merge...

Global In Shell Upload

Exploit Title: Global In - Arbitrary File Upload Google Dork: N/A Date: 11.03.2017 Vendor Homepage: https://www.techbizstudio.com/ Software: https://www.techbizstudio.com/product/linkedin-clone/ Demo: https://www.techbizstudio.com/demo/globalin/ Version: N/A Tested on: Win7 x64, Kali Linux x64...

WordPress Google Analytics Dashboard Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Google Analytics Dashboard plugin, which allows attackers to fra...

WordPress Adminer Plugin Allows Public Admin (Local) Database Login Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The WordPress Adminer plugin allows public administrative local database logins, which can be exploited by an attacker to log...

Google Analytics Dashboard - Authenticated Cross-Site Scripting (XSS)

The google-analytics-dashboard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

osTicket 1.9.12 Cross Site Scripting

------------------------------------------------------------------------ Multiple persistent Cross-Site Scripting vulnerabilities in osTicket ------------------------------------------------------------------------ Han Sahin, July 2016...

Fastspot BigTree CMS Input Validation Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An input validation vulnerability exists in Fastspot BigTree CMS versions prior to 4.2.15, which stems from a failure of the program to adequately filter the id HTTP GET...

Administrators should have the ability to restrict access to the System dashboard

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-64165. panel Administrators should have the ability to restrict access to the System dashboard which by default is available to the public...

Administrators should have the ability to restrict access to the System dashboard

Administrators should have the ability to restrict access to the System dashboard which by default is available to the public...

Administrators should have the ability to restrict access to the System dashboard and the Browse Projects Page

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-64165. panel Administrators should have the ability to restrict access to the System dashboard and the Browse Projects Page which by default...

Design/Logic Flaw

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

Faraday v2.3 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...