Zomato: [www.zomato.com] SQLi - /php/██████████ - item_id

Thanks @gerbenjavado for helping us keep @zomato secure : Thanks to the entire @Zomato team for doing this challenge. Its a pleasure to be back in the bug bounty game after a while. Introduction So I managed to find SQLi on https://www.zomato.com/php/██████████ in the POST parameter itemid...

UBUNTU-CVE-2016-8640

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...

CVE-2016-8640

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...

CVE-2016-8640

PyCSW is vulnerable to a SQL injection in all versions before 2.0.2, 1.10.5, and 1.8.6, allowing read/exfiltration of data from any table the DB user can access; on PostgreSQL it may also enable updates/inserts/deletes to covered tables. The vulnerability is confirmed across multiple sources (NVD...

Lightning Fast Web Crawler: Photon

Photon is a lightning fast web crawler which extracts URLs, files, intel & endpoints from a target. 160 requests per second while extensive data extraction is just another day for Photon! Main Features Data Extraction Photon extracts the following data while crawling by default: URLs in-scope &...

PT-2018-5042

Name of the Vulnerable Software and Affected Versions pycsw versions prior to 2.0.2 pycsw versions prior to 1.10.5 pycsw versions prior to 1.8.6 Description A SQL injection issue affects the pycsw database, allowing unauthorized access to read and extract data from any table that the database use...

Shopify: Admin bar: Incomplete message origin validation results in XSS

This issue is very similar to https://hackerone.com/reports/381192, identical logic in a different script. The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/adminbarinjector-7461c2cab955bf9ef3df40acd10741df8c4e27c86d9dc323f65a4e786a1786f2.js loaded by the shop front when the...

Apache, IBM Patch Critical Cloud Vulnerability

Apache and IBM have patched a critical vulnerability that allows attackers to replace a company’s serverless code with their own malicious script. Once running, the bad code could then be used for a range of nefarious tasks, including extracting confidential customer data such as passwords or...

IBM fixes flaw that let hackers replace its serverless code with their own

By Waqas This is the first publicly-disclosed vulnerability in a serverless platform. Experts at IBM The International Business Machines Corporation have patched a critical vulnerability in its Cloud Functions which if exploited could allow remote malicious hackers to replace company's serverless...

Hindsight - Internet History Forensics For Google Chrome/Chromium

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications with more to come!. Hindsight can parse a number of different types of web artifacts, including URLs, download...

CVE-2018-13108: Undefined Security Weakness

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of the ISP e.g., VoIP credentials or attack th...

See how I dig in and successfully exploited India's Popular Sports company web site Host header SQL injection vulnerability-vulnerability warning-the black bar safety net

Today I want to share one I'm doing bugbounty project, discovered a very interesting vulnerability, and this vulnerability appeared in India, a popular sports company website. This article is about“how do I use the host header to find out theSQL injectionvulnerabilities, and the use of sqlmap...

PT-2018-18793

Name of the Vulnerable Software and Affected Versions CA Privileged Access Manager versions 2.x Description The issue is related to improper input validation, allowing remote attackers to conduct SQL injection attacks. This enables attackers to potentially extract or modify sensitive data from th...

CVE-2018-12336

Undocumented Factory Backdoor in ECOS Secure Boot Stick aka SBS 5.6.5 allows the vendor to extract confidential information via remote root SSH access...

SUSE-SU-2018:1582-1 Security update for xen

This update for xen fixes one issue. This security issue was fixed: - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass SSB, Variant 4 bsc1092631...

Backdoors in D-Link’s backyard

"If you want to change the world, start with yourself." In the case of security research this can be rephrased to: "If you want to make the world safer, start with the smart things in your home." Or, to be more specific, start with your router – the core of any home network as well as an...

Malicious Package

Overview Version 1.0.5 of dictum.js contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.5 of this module is found installed y...

Malicious Package

Overview Version 1.0.2 of oauth-validator contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.2 of this module is found...

Malicious Package

Overview Version 0.1.1 of modlibrary contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.1.1 of this module is found installed...

Malicious Package

Overview Version 0.0.3 of jasmin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.0.3 of this module is found installed you...