Fiyo CMS 2.0.6.1 Privilege Escalation Vulnerability

Fiyo CMS version 2.0.6.1 suffers from a privilege escalation vulnerability due to poor design with trusting the client to tell the server a user's role. Exploit Title: Privilege Escalation Manipulation of User Group Vulnerability on Fiyo CMS 2.0.6.1 Google Dork: no Date: 11-03-2017 Exploit Author...

IntelMQ - A solution for IT security teams for collecting and processing security feeds using a message queuing protocol

IntelMQ is a solution for IT security teams CERTs, CSIRTs, abuse departments,... for collecting and processing security feeds such as log files using a message queuing protocol. It's a community driven initiative called IHAP Incident Handling Automation Project which was conceptually designed by...

ICAutosales 1.2 SQL Injection

Title: ICAutosales v1.2 - SQL Injection Credit: Bilal KARDADOU Vendor: http://www.icloudcenter.com Vendor URL: http://www.icloudcenter.com/auto-dealer-car-sales-script.htm Product: AUTO DEALER CAR SALES PHP SCRIPT. Google Dork: N/A Product & Service Introduction: ICAutosales is a powerful, highly...

PHP Entrepreneur 1.2 SQL Injection

Title: PHP Entrepreneur Script v1.2 - SQL Injection Credit: Bilal KARDADOU Vendor: www.jobportalscript.com Vendor URL: http://www.jobportalscript.com/entrepreneur-home-basic- version.html Product: PHP Entrepreneur Script. Entrepreneur Script Feature Document : http://www.jobportalscript...

Agora-Project 3.2.2 Cross Site Scripting

Exploit Title: XSS Vulnerability on Agora-Project 3.2.2 Google Dork: no Date: 23-02-2017 Exploit Author: @runggareksya, @AdyWikradinata, @yokoacc Vendor Homepage: https://www.agora-project.net Software Link: https://www.agora-project.net/?ctrl=offline&action=download Software Link Mirror:...

Job Portal Script 3.0 Cross Site Scripting / SQL Injection

Title: Job portal Script v3.0 - SQL Injection / Cross Site Scripting Credit: Bilal KARDADOU Vendor: www.jobportalscript.com Vendor URL: http://www.jobportalscript.com/index.html Product: Job portal site. Google Dork: categorysearch.php?indus= placementpaper.php?pn= ... Product & Service...

MBLS Flex CMS 0.7.2 SQL Injection / Cross Site Scripting

Title: SQL injection & Cross-site scripting in CMS Flex Credit: Bilal KARDADOU Vulnerability: SQL injection & Cross-Site scripting Vulnerable version: Flex Version 0.7.2 Vendor: MBL Solutions Ltd Vendor URL: http://www.mblsolutions.co.uk/ Product: FLEX CMS "THE INTUITIVE CONTENT MANAGEMENT SYSTEM...

CVE-2016-10216

ITDB 1.23 and earlier permits XSS via insufficient filtering of the value POST parameter sent to itdb-1.23/js/DataTables-1.8.2/examples/examples_support/editable_ajax.php. An attacker could inject and execute arbitrary HTML/JavaScript in a user’s browser within the vulnerable website context. The...

WMD (Weapon of Mass Destruction) - Python framework for IT security tools

This is a python tool with a collection of IT security software. The software is incapsulated in "modules". The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command "use modulecall", e.g. "use apsniff", to activate the module. ...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

Exploits and Security Tools Framework: EaST Framework

Exploits and Security Tools Framework Pentest framework environment is the basis of IT security specialist’s toolkit. This software is essential as for learning and improving of knowledge in IT systems attacks and for inspections and proactive protection. The need of native comprehensive open...

NEET - Network Enumeration and Exploitation Tool

Neet is a flexible, multi-threaded tool for network penetration testing. It runs on Linux and co-ordinates the use of numerous other open-source network tools, with the aim of gathering as much network information as possible in clear, easy-to-use formats. The core scanning engine finds and...

Scan Reveals Hydropower Plants, Other Critical Infrastructure Exposed Online

An Internet scan of the IPv4 address space uncovered more than 100 critical facilities exposed to the public Internet, including hydropower plants in Germany and Italy, and a smart building in Israel hosting luxury apartments. The investigation, conducted by researchers at Internet Wache of Berli...

OpenXchange User Enumeration

Hi@all, there is an information disclosure in OpenXchange prior 7.8. An authenticated user can enumerate all imap user folders. If you browse the PoC you get an permission denied error, but the folder’s name is reflected into the page in json format. About Open Xchange: Open-Xchange2 develops,...

Hackazon - A Modern Vulnerable Web App

Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective training and...

How to become an Information Security Expert with the CISSP Certification

If you dream of making it big in the IT security community, the CISSP certification is a necessary milestone. Having this certification to your credit portrays a sense of commitment to the security profession and shows potential employers that you have a strong knowledge base to excel in this...

Millions of IoT Devices Using Same Hard-Coded CRYPTO Keys

Millions of embedded devices, including home routers, modems, IP cameras, VoIP phones, are shareing the same hard-coded SSH Secure Shell cryptographic keys or HTTPS HTTP Secure server certificates that expose them to various types of malicious attacks. A new analysis by IT security consultancy SE...

Researcher warns about Security Loopholes in Denmark's Largest Bank

While accessing your Bank account online, Have you ever thought… ...there could be a Hacker, somewhere in the World, who is after your Money? Maybe NO. Because, you believe that your bank offers Secure banking solution, Right? At The Hacker News, we have reported many incidents of cyber attacks,...

Python for Security Professionals: Free IT Security Training

Python is an excellent programming language that has rapidly become popular among Hackers, Reverse engineers, software testers, Forensic analyst and Penetration testers. Python is a simple object-oriented and minimalistic language that is easy to learn for novice programmers as well as experience...

RSA Conference Chris Hoff Reuben Paul Keynote

SAN FRANCISCO – When it comes to the future development of secure software, there’s really only one “next generation” that matters. That’s why today when the covers were pulled back on a seven-foot-tall server rack wheeled out on stage during Chris Hoff’s RSA Conference keynote, those in the...