Authorization

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

CVE-2017-7505

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organizations can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global...

PhishingKitHunter - Find Phishing Kits Which Use Your Brand/Organization'S Files And Image

Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write in Python 3 - is...

Secure Mail gives Error: Your organization does not allow this action

- User opens Secure Mail. - Goes into Contacts. - Selects a contact. - Clicks on the contacts phone number. - Sees error message:Your organization does not allow this action...

ilo.org XSS vulnerability

Vulnerable URL: http://ilo.org/Search5/search.do?locale=%22%3E%3Ca%2Fhref%3Djavascript%26colon%3Bco%5Cu006efir%5Cu006d%26%2340%3B%26quot%3B1%26quot%3B%26%2341%3B%3Eclickme%3C%2Fa%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS...

New Relic: /accounts/USERID.json file is left open for Restricted User of organization disclosing Owners's Mobile Number and "billing_info, cc_email"

Hello Team, Vulnerable Url: https://rpm.newrelic.com/accounts/USERID.json Description of the Bug: As Restricted user for an organization cannot Add New users to the Organization, cannot change Organization Name, cannot generate or download report as well as cannot read the information of Owner...

OSINT Gathering Tool: Inquisitor

OSINT Gathering Tool Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to...

E-mail Address Disclosure

Email addresses are typically found on "Contact us" pages, however, they can also be found within scripts or code comments of the application. They are used to provide a legitimate means of contacting an organisation. As one of the initial steps in information gathering, cyber-criminals will spid...

The Missing Trends in M-Trends 2017

FireEye released the 2017 edition of the Mandiant M-Trends report yesterday. I've been a fan of this report since the 2010 edition, before I worked at the company. Curiously for a report with the name "trends" in the title, this and all other editions do not publish the sorts of yearly trends I...

ceth.org XSS vulnerability

Vulnerable URL:...

skoda.org XSS vulnerability

Open Bug Bounty ID: OBB-216878 Description| Value ---|--- Affected Website:| skoda.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

swisstools.org XSS vulnerability

Open Bug Bounty ID: OBB-215406 Description| Value ---|--- Affected Website:| swisstools.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 24 Update: shotwell-0.24.5-1.fc24

Shotwell is an easy-to-use, fast photo organizer designed for the GNOME desktop. It allows you to import photos from your camera or disk, organize them by date and subject matter, even ratings. It also offers basic photo editing, like crop, red-eye correction, color adjustments, and straighten...

washington.org XSS vulnerability

Vulnerable URL: https://washington.org/search/%22%3E%3Csvg%5Conload%3Dalert%28%5Copenbugbounty%5C%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 71199 VIP website status:| No...

nyise.org XSS vulnerability

Open Bug Bounty ID: OBB-205746 Description| Value ---|--- Affected Website:| nyise.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Platform Independent Meta Information Editor: ExifTool

Platform Independent Meta Information Editor ExifTool is a platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files. ExifTool supports many different metadata formats including EXIF, GPS, IPTC, XMP, JFIF, GeoTIF...

HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability

Talos Vulnerability Report TALOS-2016-0179 HDF5 Group libhdf5 H5TCOMPOUND Code Execution Vulnerability November 17, 2016 CVE Number CVE-2016-4333 Description HDF5 is a file format that is maintained by a non-profit organization, The HDF Group. HDF5 is designed to be used for storage and...

Dutch Hacker Who Almost Broke The Internet Escapes Jail

The Dutch hacker, who in 2013 was accused of launching the biggest cyberattack to date against the anti-spam group Spamhaus, escaped prison Monday even after he was sentenced to nearly 8 months in jail because most of his term was suspended. Sven Olaf Kamphuis, 39, was arrested in April 2013 by...

kompeople.org XSS vulnerability

Vulnerable URL: http://www.kompeople.org/munteh/en2kom/en2komrpc.php?queryString=Aa=prompt/OPENBUGBOUNTY/...

CVE-2016-8639

It was found that foreman is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface...