5757 matches found
Hansa Market on Dark Web seized by Dutch police
In a simultaneous press conference issued by the Dutch police and US Attorney General Jeff Sessions we learned that the Dark Web market places Alphabay and Hansa market have been seized and shut down by international cooperating authorities. As it turned out Hansa Market was already under control...
CVE-2017-7538
A cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users...
GSA Bounty: The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout
Description Hi. I found a non-critical session management bug, which still can have serious impact in some scenarios. When user perform login to the Federalist through Github, federalist checks his Organization ID but only upon login. When the user was deleted from organization for some reasons,...
niso.org XSS vulnerability
Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...
albemarle.org XSS vulnerability
Vulnerable URL: http://www.albemarle.org/department.asp?department=1"...
ICS & SCADA Situational Awareness: Grassmarlin
ICS & SCADA Situational Awareness GRASSMARLIN is an open-source software tool that provides a method for discovering and cataloging Supervisory Control & Data Acquisition SCADA and Industrial Control System ICS hosts on IP-based networks. GRASSMARLIN uses a variety of sources to generate this dat...
neaman.org.il XSS vulnerability
Vulnerable URL: http://www.neaman.org.il/Neaman2011/Templates/ShowPage.asp?DBID=1=2=131=266 Details: Description| Value ---|--- Patched:| Yes, at 26.11.2017 Latest check for patch:| 26.11.2017 15:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3973143 VIP...
Visualizing the Stack Clash Vulnerability with Dashboards
Security teams should apply vendor patches immediately to protect their Linux, OpenBSD, NetBSD, FreeBSD and Solaris infrastructure from The Stack Clash vulnerability also see the security advisory. To help in that effort, this blog post describes a new built-in Qualys AssetView dashboard to...
A Look at --- SharePoint's Follow Feature XSS(CVE-2017-8514 )
A Look at CVE-2017-8514 --- SharePoint's Follow Feature XSS TL;DR: All your SharePoint installations are belong to us. The XSS worth $2500 affecting both on-premises and online version looks like ... http|https://?FollowSite=0&SiteName='-confirmdocument.domain-' SharePoint needs no more marketing...
CVE-2017-0896
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...
CVE-2017-7505
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...
Authorization
Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...
PhishingKitHunter - Find Phishing Kits Which Use Your Brand/Organization'S Files And Image
Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write in Python 3 - is...
Secure Mail gives Error: Your organization does not allow this action
- User opens Secure Mail. - Goes into Contacts. - Selects a contact. - Clicks on the contacts phone number. - Sees error message:Your organization does not allow this action...
ilo.org XSS vulnerability
Vulnerable URL: http://ilo.org/Search5/search.do?locale=%22%3E%3Ca%2Fhref%3Djavascript%26colon%3Bco%5Cu006efir%5Cu006d%26%2340%3B%26quot%3B1%26quot%3B%26%2341%3B%3Eclickme%3C%2Fa%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS...
New Relic: /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email"
Hello Team, Vulnerable Url: https://rpm.newrelic.com/accounts/USERID.json Description of the Bug: As Restricted user for an organization cannot Add New users to the Organization, cannot change Organization Name, cannot generate or download report as well as cannot read the information of Owner...
OSINT Gathering Tool: Inquisitor
OSINT Gathering Tool Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to...
E-mail Address Disclosure
Email addresses are typically found on "Contact us" pages, however, they can also be found within scripts or code comments of the application. They are used to provide a legitimate means of contacting an organisation. As one of the initial steps in information gathering, cyber-criminals will spid...
The Missing Trends in M-Trends 2017
FireEye released the 2017 edition of the Mandiant M-Trends report yesterday. I've been a fan of this report since the 2010 edition, before I worked at the company. Curiously for a report with the name "trends" in the title, this and all other editions do not publish the sorts of yearly trends I...