bulletin.engineering.nyu.edu XSS vulnerability

Vulnerable URL: http://bulletin.engineering.nyu.edu/portfolionopop.php/"--!" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure Timeline:...

Wix Remote Email PoC 0day

Wix send remote email affects all pages created with wix.com, possible social engineering attack. Usage Info usage: exploit.py -h -u URL -t EMAILTO -f EMAILFROM -s SUBJECT -i SITEID -m MESSAGE This is private exploit. You can buy it at https://0day.today...

Coinbase: Requestor Email Disclosure via Email Notification

When a Coinbase user requests money from another coinbase user, the user that receives the request sees an email that says, in part: John Smith [email protected] sent you a request to pay 1 BTC using Coinbase. Where John Smith is the sending account's display name meaning you can make it whatever you...

Nicolas Brulez on Malware Reverse Engineering Tips and Tricks

Kaspersky Lab Principal Security Researcher Nico Brulez talks with Ryan Naraine about his upcoming SAS 2017 training on the ins and outs of malware reverse engineering and how attendees can benefit for a wide range of tips and tricks. Download:...

BINOM3 Electric Power Quality Meter (Update A)

CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...

BINOM3 Electric Power Quality Meter

CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...

Multi-Architecture GDB Enhanced Features for Exploiters & Reverse-Engineers: GEF

Multi-Architecture GDB Enhanced Features for Exploiters & Reverse-Engineers GEF is a kick-ass set of commands for X86, ARM, MIPS, PowerPC and SPARC to make GDB cool again for exploit dev. It is aimed to be used mostly by exploiters and reverse-engineers, to provides additional features to GDB usi...

Phishers unleash simple but effective social engineering techniques using PDF attachments

The Gmail phishing attack is reportedly so effective that it tricks even technical users, but it may be just the tip of the iceberg. We’re seeing similarly simple but clever social engineering tactics using PDF attachments. These deceitful PDF attachments are being used in email phishing attacks...

Oracle Weblogic Server Deserialization RCE - RMI UnicastRef

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object sun.rmi.server.UnicastRef to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializeunicastref msf...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

Open-Xchange: Information About Your System(Sensitive Directories)

This vulnerability can read your plugins like you are using jQuery Superfish,jsquary easy etc... and emails... Sensitive Directories...for social engineering emails, directories, plugins is so important you should hide this. I share with files you can look file is saying everything...

Slack: Access of Android protected components via embedded intent

@bagipro found a vulnerability wherein a malicious and unprivileged app on the victim's phone could interact with any activity in the Slack Android app, allowing manipulation of the app in unintended ways. Thanks for the finding @bagipro! I found the following code inside com.Slack.ui.HomeActivit...

Microsoft Power Point 2016 - Java Code Execution

Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial : https://www.youtube.com/watch?v=Lih-iuXgEM Youtube Channel...

IC3 Warns of Employment Scams Targeting College Students

The Internet Crime Complaint Center IC3 has issued an alert on employment scams targeting college students. Phony job opportunities are advertised via college employment websites or students’ university emails. Unfortunately, students who take the bait suffer financial losses. US-CERT encourages...

Huawei P9 Plus TP Driver Input Checksum Vulnerability

Huawei P9 Plus is a smartphone product from Huawei, China. An input checksum security vulnerability exists in the touchscreen driver of the Huawei P9 Plus phone. An attacker could trick users into installing a malicious application, and the application could exploit the vulnerability to send...

New Variant of Ploutus ATM Malware Observed in the Wild in Latin America

Introduction Ploutus is one of the most advanced ATM malware families we’ve seen in the last few years. Discovered for the first time in Mexico back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message, a technique that had...

New Variant of Ploutus ATM Malware Observed in the Wild in Latin America

Introduction Ploutus is one of the most advanced ATM malware families we’ve seen in the last few years. Discovered for the first time in Mexico back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message, a technique that had...

17 Essential Skills for Performance Engineers

Most people in the performance engineering field agree that our skillset is derived from an intersection of disciplines that include testing, optimization, and systems engineering...

From MS16-098 see a Windows 8.1 kernel exploit-vulnerability warning-the black bar safety net

When I first started contact core vulnerability when I don't have any about the kernel of the experience, not to mention to take advantage of a kernel vulnerability, but I'm always for reverse engineering and exploit techniques are very interested. Initially, my idea was simple: find one not...

urbanengineering.utoronto.ca XSS vulnerability

Vulnerable URL: http://www.urbanengineering.utoronto.ca/flashdetection.swf?flashContentURL=javascript:alert/OPENBUGBOUNTY/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown /...