8379 matches found
Faraday v3.5 - Collaborative Penetration Test and Vulnerability Management Platform
Here’s the main new features and improvements in Faraday v3.5: New vulnerability form We are happy to introduce our new vulnerability form which makes the creation and editing of vulnerabilities easier. The new form brings you tabs to make it smaller and group different fields. Custom fields Add...
Linux: Package updates available
Package updates may include vulnerability fixes or new functionality to a package. Keeping the packages to the newest available version reduces the risk of a successful attack. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...
Cryptopia cryptocurrency exchange hacked; suffers “significant losses”
By Waqas Cryptopia, a New Zealand based cryptocurrency exchange has undercome a cyber attack leading to “significant losses.” The incident took place on January 14 and upon detecting the attack Cryptopia was forced to halt services by taking their website and exchange offline. Initially, on its...
Authorization Bypass
samba is vulnerable to authorization bypas. An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path...
New Relic: Bypass of #447975 - view mobile application token though "Application Information" sidebar on Installation page
In 447975 I demonstrated that it was possible to view the application token for a mobile app by visiting the upgrade page - this was subsequently fixed by disallowing access completely for a restricted user to view that page. I've found a workaround to this fix, and in doing so I've enable my...
New Relic: GET request to accounts.json on support site leaks the root account license key and the browser license key to a restricted user
Overview As a restricted user, you cannot view the main account license key. If you are logged into your restricted user account, and visit https://support.newrelic.com/, when you attempt to create a ticket the root account license key will be exposed in the request. Steps to Reproduce 1. From a...
Does WhatsApp Have A Privacy Bug That Could Expose Your Messages?
In-short conclusion—Whatsapp service or its 45-days deletion policy doesn't seem to have a bug. For detailed logical explanation, please read below. An Amazon employee earlier today tweeted details about an incident that many suggest could be a sign of a huge privacy bug in the most popular...
The world’s southernmost security conference
When asked about his best race, Ayrton Senna replied that it was when he raced karting cars. For him it was the best because it was only for the sake of sports and free from commercial sponsoring and commercial interests. I have this same feeling about computer security conferences, because they...
CVE-2018-16205
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal...
CVE-2018-16205
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal...
Cross site scripting
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal...
CVE-2018-16205
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal...
New Relic: IDOR allows accounts to view full name of other accounts based on email through share notes feature
This is a similar IDOR that I've reported in the past - but now that "anything goes" is in scope I looked around and tried to find other areas within the application that this might exist in. And I found it while sharing a note: Steps to Reproduce From new user creation page: 1. Add a new user to...
phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting
Exploit Title: phpMoAdmin 1.1.5 - MongoDB GUI | Multiple Vulnerabilities Date: 03.01.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.phpmoadmin.com Software Link: http://www.phpmoadmin.com/file/phpmoadmin.zip Version: 1.1.5 Introduction phpMoAdmin - MongoDB GUI MongoDB administration...
January 8, 2019—KB4483203 Update for Windows 10 Mobile (OS Build 15254.547)
January 8, 2019—KB4483203 Update for Windows 10 Mobile OS Build 15254.547 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: This build includes all the improvements from KB4480973. If you...
Fedora 28 : kernel / kernel-tools (2018-2c6bd93875)
The 4.17.2 kernel rebase contains new drivers, new features, and a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it...
Fedora 28 : firefox (2018-bb6bedbe7f)
Updated to new version 61.0 - Created new subpackage with Wayland launcher firefox-wayland Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...
Fedora 28 : mkvtoolnix (2018-317ecbb54f)
Version 28.2.0 'The Awakening' 2018-10-25 Bug fixes - mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool & chapter editor: fixed a case of memory being accessed after it had been freed earlier. This can be triggered by specially crafted Matroska files and lead to arbitrary cod...
New Kickass Torrents Site: List of New 2024 Proxies and Alternatives
Kickass Torrents KAT cr was once a hugely popular online portal, renowned for its vast archive of movies, music, TV shows, and other media. It was a treasure trove for those seeking rare content and for users looking to share their creations. However, Kickass Torrents faced significant opposition...
