Happy 15th Birthday TaoSecurity Blog

Today, 8 January 2018, is the 15th birthday of TaoSecurity Blog! This is also my 3,020th blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. I don't believe I've released statistics for the blog before, so here are a few. Blogger...

Instagram-Py - Simple Instagram Brute Force Script

Instagram-Py is a simple python script to perform basic brute force attack against Instagram , this script can bypass login limiting on wrong passwords , so basically it can test infinite number of passwords. Instagram-Py is proved and can test over 6M passwords on a single instagram account with...

WordPress mgl-instagram-gallery plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL servers to set up a personal blog site. mgl-instagram-gallery plugin is used in one of the responsive gallery plugin. A cross-site scripting...

CVE-2017-17869

The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter...

CVE-2017-17869

The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter...

Design/Logic Flaw

The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter...

CVE-2017-17869: Improper Neutralization of Input During Web Page Generation

The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter...

CVE-2017-17869

The CVE-2017-17869 entry concerns the WordPress plugin mgl-instagram-gallery . A Cross‑Site Scripting (XSS) vulnerability exists in the plugin’s single-gallery.php file via the media parameter, as described by CVE entries and CNVD/NVD records. The issue is caused by handling the media parameter i...

yogastudiongotland.se XSS vulnerability

Open Bug Bounty ID: OBB-457675 Description| Value ---|--- Affected Website:| yogastudiongotland.se Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

PT-2017-15058

Name of the Vulnerable Software and Affected Versions mgl-instagram-gallery plugin for WordPress affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the media parameter in the single-gallery.ph...

WordPress mgl-instagram-gallery Plugin Cross Site Scripting Vulnerability

Exploit for php platform in category web applications + Title: WordPress mgl-instagram-gallery Plugin Cross Site Scripting XSS + Author: Mostafa Gharzi + Vendor Homepage: www.Wordpress.org , www.pluginu.com/mgl-instagram-gallery/ + Tested on: Windows 10 & Kali Linux + Vulnerable File:...

iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service Exploit

Exploit for iOS platform in category dos / poc Exploit Title: TpwnT - iOS Denail of Service POC Date: 10-31-2017 Exploit Author: Russian Otter Ro Vendor Homepage: https://support.apple.com/en-us/HT208222 Version: 2.1 Tested on: iOS 10.3.2 - 11.1 CVE: CVE-2017-13849 """ -------------------------...

iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service

Exploit Title: TpwnT - iOS Denail of Service POC Date: 10-31-2017 Exploit Author: Russian Otter Ro Vendor Homepage: https://support.apple.com/en-us/HT208222 Version: 2.1 Tested on: iOS 10.3.2 - 11.1 CVE: CVE-2017-13849 """ ------------------------- CVE-2017-13849 TpwnT by Ro of SavSec...

WordPress Ultimate Instagram Feed plugin <=1.3.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Gilzow in WordPress Ultimate Instagram Feed plugin versions =1.3.1. Solution We were unable to find a complete changelog for this plugin, but there is 1.3.3 version available. Use it at your own risk!...

WordPress Ultimate Instagram Feed Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Ultimate Instagram Feed plugin is a photo wall plugin used in... A cross-site scripting vulnerability exists i...

Ultimate Instagram Feed <= 1.3.1 - Authenticated Cross-Site Scripting (XSS)

In regards to https://wpvulndb.com/vulnerabilities/8947, the XSS vulnerability remains in 1.3 and 1.3.1 as the author passes GET'accesstoken' to sanitizetextfield. However, the value is inserted into an attribute of an element, and sanitizetextfield does not filter for quotes single or double...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

CVE-2017-16758

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

CVE-2017-16758

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

CVE-2017-16758

CVE-2017-16758 affects WordPress via the Ultimate Instagram Feed plugin up to version 1.3, in the admin/partials/uif-access-token-display.php file. The vulnerability is an XSS in which the attacker can inject script/HTML through the access_token parameter, with evidence of a PoC demonstrating ref...