Mobile Application Testing Toolkit: Scrounger

Even though several other mobile application analysis tools have been developed, there is no one tool that can be used for both android and ios and can be called a “standard” must use on every mobile application assessment. The idea behind Scrounger is to make a metasploit-like tool that will not...

MyBB Eldenroot Thank You/Like plugin cross-site scripting vulnerability

MyBB aka MyBulletinBoard is MyBB team developed a set of PHP and MySQL development of free and Web-based forum software. Eldenroot Thank You/Like plugin is used in one of the appreciation of the plugin. A cross-site scripting vulnerability exists in the inc/plugins/thankyoulike.php file in versio...

Cross site scripting

inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject...

CVE-2018-14888

inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject...

CVE-2018-14888

inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject...

CVE-2018-14888

inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject...

CVE-2018-14888

CVE-2018-14888 affects the Eldenroot Thank You/Like plugin for MyBB (versions before 3.1.0). The vulnerability is a cross-site scripting (XSS) flaw in inc/plugins/thankyoulike.php where the post or thread subject is not properly sanitized, allowing an attacker to inject malicious scripts that exe...

MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE:...

MyBB Like Plugin 3.0.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: This plugin allo...

MyBB Thank You / Like 3.0.0 Cross Site Scripting

Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14888 1. Description: This plugin...

MyBB Like 3.0.0 Cross Site Scripting

Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting Date: 2018-08-01 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: This plugin allows users to thank/like other users...

MyBB Like Plugin 3.0.0 - Cross-Site Scripting

MyBB Like Plugin 3.0.0 - Cross-Site Scripting Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting Date: 2018-08-01 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: This...

MyBB Like Plugin 3.0.0 - Cross-Site Scripting

Exploit Title: MyBB Like Plugin 3.0.0 - Cross-Site Scripting Date: 2018-08-01 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: This plugin allows users to thank/like other users...

MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting

Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14888 1. Description: This plugin...

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu...

Node.js third-party modules: Prototype Pollution Vulnerability in mpath Package

I would like to report prototype pollution vulnerability in mpath. It allows an attacker to inject arbitrary properties on Object.prototype. Module module name: mpath version: 0.4.1 npm page: https://www.npmjs.com/package/mpath Module Description G,Set javascript object values using MongoDB-like...

Security Bulletin: TADDM – Security improvement: More restricted permission on TADDM files on UNIX-like servers.

Summary TADDM security improvement deployed started from TADDM 7.2.1.5 and in TADDM 7.2.2 that restrict access to TADDM files on UNIX-like servers. Vulnerability Details CVE-2013-4040 Description Default TADDM file permission on UNIX-like servers, by default are 755 rwx r-x r-x, that allow all...

Security Bulletin: Multiple vulnerabilities affecting web servers that run code in a CGI or CGI-like context affects IBM API Connect (CVE-2016-5385, CVE-2016-1000105)

Summary IBM API Connect is affected by multiple vulnerabilities relating to web servers that run code in a CGI or CGI-like context CVE-2016-5385, CVE-2016-1000105. IBM has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-5385 DESCRIPTION: PHP could allow a remote attacker to...

Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)

Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...

Exim SMTP listener base64d function one-character buffer overflow

Added: 05/16/2018 CVE: CVE-2018-6789 BID: 103049 Background Exim is a mail transfer agent used on Unix-like operating systems. Problem Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the base64d function in the SMTP listener. Resolution Upgrade to Exim 4.90.1 or higher,...