WordPress Spider Event Calendar 1.5.51 Blind SQL Injection

============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

WordPress REST API Bug Could Be Used in Stored XSS Attacks

The recently patched WordPress REST API Endpoint vulnerability is the gift that keeps on giving. Already responsible for more than one million website defacements and attempts to monetize some of those attacks, the flaw also opens the door to a separate attack. Researchers at Sucuri who found the...

Nextcloud: http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement

Good day, I truly hope it treats you well on your side of the screen : I have found that your website uses the flash file: swfupload.swf to allow your users to upload files. The tl;dr version of this bug report is it allows an open redirect to any site a non kind person may want to exploit or...

Criminals Monetizing Attacks Against Unpatched WordPress Sites

Criminals have inevitably begun to attempt to monetize attacks against WordPress sites still vulnerable to a severe REST API endpoint vulnerability silently patched in the recent 4.7.2 security update. While more than one million websites have been defaced, researchers are now beginning to see so...

President Donald Trump's Website Hacked; Defaced By Iraqi Hacker

During the 2016 presidential election campaign, we reported about how insecure was the mail servers operated by the Trump organization that anyone with little knowledge of computers can expose almost everything about Trump and his campaign. Now, some unknown hackers calling themselves "ProMast3r"...

Attackers Capitalizing on Unpatched WordPress Sites

Attackers didn’t wait long to capitalize on laggards slow in updating their WordPress sites to patch a critical content injection vulnerability addressed in WordPress 4.7.2. The update was made public on Jan. 26 with WordPress disclosing six days later that the update also included a silent fix f...

WordPress 4.7.0 / 4.7.1 REST API Privilege Escalation Exploit

WordPress versions 4.7.0 and 4.7.1 REST API post privilege escalation and defacement exploit. !/usr/bin/env python ''' WordPress 4.7.0-4.7.1 REST API Post privilege escalation / defacement exploit @dustyfresh Date: 02-01-2017 Original vuln disclosed by Sucuri's research team Reference:...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

Exponent CMS 2.3.9 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2016-005 - Original release date: September 09, 2016 - Last revised: September 20, 2016 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2016-7400...

SecNews: Querying private posts and changing post meta

Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...

GLSA-201607-10 : Varnish: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201607-10 Varnish: Multiple vulnerabilities Varnish fails to properly validate input from HTTP headers, and does not deny requests with multiple Content-Length headers. Impact : Remote attackers could conduct an HTTP response...

Tiki Wiki CMS Calendar 14.2 / 12.5 LTS / 9.11 LTS / 6.15 - Remote Code Execution

Exploit for php platform in category web applications Exploit Title: Tiki-Calendar-RCE Google Dork: inurl:tiki-calendar.php Date: 2015-12-16 Exploit Author: Dany Ouellet Vendor Homepage: https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki Software Link:...

CMS Made Simple Cache Poisoning

============================================= Web Server Cache Poisoning in CMS Made Simple ============================================= CVE-2016-2784 Product Description =================== CMS Made Simple is a great tool with many plugins to publish content on the Web. It aims to be simple to...

ImpressCMS 1.3.9 - SQL Injection

ImpressCMS 1.3.9 - SQL Injection ============================================= MGC ALERT 2016-002 - Original release date: April 8, 2016 - Last revised: April 21, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I...

Uber: Stored XSS in developer.uber.com

An attacker can make a series of requests to https://uber.readme.io/ that will result in permanent defacement/stored XSS of all the documentation pages on https://developer.uber.com/ I'm not entirely sure if this is in scope, but it could definitely have a major impact on developer.uber.com so I...

Zen Cart Shopping Cart App Plugs Big XSS Vulnerability

Popular open source shopping cart app Zen Cart is warning its users of dozens of cross-site scripting vulnerabilities found in its software. Affected websites, security experts say, risk exposing customers to malware, theft of cookies data and site defacement. Researchers at the security firm...

Uber: SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/

The Wordpress blog located at https://drive.uber.com/frmarketplace/ had a plugin called Huge IT Video Gallery which suffered from an SQL injection vulnerability. While this site did not contain customer information, the vulnerability could be possibly used to deface the Wordpress blog or extract...

Opendocman 1.3.4 HTML Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: HTML Injection Remote Exploitable: Yes Reported to vendor:...

Shopify: HTTP-Response-Splitting on v.shopify.com

I discovered a HTTP-Response-Splitting issue on v.shopify.com Steps to reproduce: Call the following URL in any browser and catch the response e.g. with burp...

WebComIndia CMS 2015Q4 Authentication Bypass Vulnerability

WebComIndia CMS 2015Q4 suffers from an authentication bypass vulnerability via remote SQL injection. Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability Product & Service Introduction: =============================== Where quality & reliability converge. Web.Com Ind...