miami-partners.com XSS vulnerability

Vulnerable URL: http://miami-partners.com/search.php?propertyType=0%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E==0=0=0==1==0=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

ironwood-partners.com XSS vulnerability

Vulnerable URL: http://www.ironwood-partners.com/teampros.php?id=13'"105 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8773123 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

Shopify: Stored XSS in partners dashboard

Hello Stored XSS and UI redressing on https://partners.shopify.com/partnerID/confirm. PoC: 1.Change your First Name and Last Name with XSS payload on https://accounts.shopify.com/account 2.Create an account on https://partners.shopify.com/ or if you have an account on...

Chris Vickery on Amazon S3 Data Leaks

Mike Mimoso talks to Chris Vickery of UpGuard of the recent rash of Amazon S3 data leaks. Vickery uncovers of the commonalities among these leaks, some of which include AWS misconfigurations and mismanagement of third-party partner relationships. Download: ChrisVickeryonAmazonS3DataLeaks.mp3...

Here's How CIA Spies On Its Intelligence Liaison Partners Around the World

WikiLeaks has just published another Vault 7 leak, revealing how the CIA spies on their intelligence partners around the world, including FBI, DHS and the NSA, to covertly collect data from their systems. The CIA offers a biometric collection system—with predefined hardware, operating system, and...

Android Security Bulletin—August 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of August 05, 2017 or later address all of these issues. Refer to the Pixel and Nexus update schedule to learn how to check a device's security patch level. Partners were...

Thousands of Security Experts Work Together to Collectively Combat Petya / NotPetya Ransomware Attack

On Tuesday, Carbon Black’s community of security experts began working together with Carbon Black Threat Research to rapidly analyze the new ransomware family that was hitting organizations from Russia to Britain. More than 100 customers and partners communicated IOCs as the attack hit. “I heard...

gateway.okhistory.org XSS vulnerability

Vulnerable URL: http://gateway.okhistory.org/explore/partners/OKHS/browse/?fq=strtitleserial:The%2520Harmon%2520County%2520Tribune'%22%26%25prompt/OPENBUGBOUNTY/...

Partnering with the AV ecosystem to protect our Windows 10 customers

On Friday May 12th, and for several days afterwards, more than a quarter-million computers around the world fell victim to the ransomware known as WannaCrypt or WannaCry. As that recent event has shown, malicious actors bring nearly boundless time and skill to commit cybercrime that can cause har...

Shopify: XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications

Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...

Uber: Session not expired When logout [partners.uber.com]

Hi, Summary ========= partners.uber.com website is not expiring the user's session immediately after logout. when user logout, the session not expired, and still can send request and the server respond response with OKAY Steps to Reproduce: - Log into the website - partners.uber.com - Capture any...

changepartners.pt XSS vulnerability

Vulnerable URL: http://www.changepartners.pt/search.php?s=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Dropbox: SSL Key Certificate expires

The report points out that the certificate for https://www.dropboxpartners.com had expired. We closed the issue as informative because we were already working on shutting down the site. The site became unavailable within a few days of the report being filed...

Taking your feedback on the Security Update Guide

The Security Update Guide has been in public preview since November 2016. This month marked our first release when security update information was published entirely in the new format. Over the last few months, customers and partners have provided a lot of feedback on the direction and...

Taking your feedback on the Security Update Guide

The Security Update Guide has been in public preview since November 2016. This month marked our first release when security update information was published entirely in the new format. Over the last few months, customers and partners have provided a lot of feedback on the direction and...

Android Security Bulletin—April 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air OTA update. The Google device firmware images have also been released to the Google Developer...

Donald Trump appoints a CyberSecurity Advisor Whose Own Site is Damn Vulnerable

Former New York City Mayor Rudolph W. Giuliani has been appointed as a cyber security advisor for the President-elect Donald Trump, but it appears that he never actually checked the security defenses of his own company's website. Giuliani is going to head a new Cybersecurity Working group for the...

Android Security Bulletin—January 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Google devices through an over-the-air OTA update. The Google device firmware images have also been released to the Google Developer...

drozdov-partners.com XSS vulnerability

Vulnerable URL: http://drozdov-partners.com/404.php?l= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2320425 VIP website status:| No Check drozdov-partners.com SSL connection:|...

partners.fanduel.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-189152 Description| Value ---|--- Affected Website:| partners.fanduel.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...