RSVP Invitation Online 1.0 Cross Site Request Forgery

...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)

RSVP Invitation Online 1.0 - Cross-Site Request Forgery Update Admin...

Ketshash - A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs

A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

mimikatz 2.1.1 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory

Mimikatz is a post-exploitation tool written by Benjamin Delpy gentilkiwi. After the initial exploitation phase, attackers may want to get a firmer foothold on the computer/network. Doing so often requires a set of complementary tools. Mimikatz is an attempt to bundle together some of the most...

pass-survey.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-456013 Description| Value ---|--- Affected Website:| pass-survey.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Abusing Windows Security: mimikatz

mimikatz is well known tool for extraction of plaintexts passwords, hashes, PIN codes and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. A lot of times after the initial exploitation phase attackers may want to get a firmer foothold...

Call For Customer Presentations at RSA Conference 2018!

Tell your security story to your peers at RSA Conference 2018 San Francisco! Qualys is looking for customers excited to share their security and DevSecOps successes, best practices and case studies leveraging the use of the Qualys Cloud Platform. Take the stage in the Qualys booth to share your...

Microsoft Office SMB Information Disclosure

Vulnerability Summary The following advisory describes an information disclosure found in Microsoft Office versions 2010, 2013, and 2016. Microsoft Office is: “Whether you’re working or playing, Microsoft is here to help. We’re the company that created Microsoft Office, including Office 365 Home,...

Oracle 9i XDB 9.2.01 HTTP PASS Buffer Overflow Exploit

Oracle 9i XDB version 9.2.0.1 HTTP PASS buffer overflow exploit. Exploit Title:Oracle 9i XDB HTTP PASS Buffer Overflow Date: 09/25/2017 Exploit Author: Charles Dardaman Twitter: https://twitter.com/CharlesDardaman Website: http://www.dardaman.com Version:9.2.0.1 Tested on: Windows 2000 SP4 CVE:...

UBUNTU-CVE-2017-14431

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service ARM or x86 AMD host OS memory consumption by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207...

DEBIAN-CVE-2017-14431

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service ARM or x86 AMD host OS memory consumption by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207...

Advertiz PHP Script 0.2 Cross Site Request Forgery

Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html Demo: http://dijiteol.com/demos/advertiz/...

Samsung, Huawei and other phone Bootloader was traced to the presence of many high-risk bug-vulnerability warning-the black bar safety net

California University research team to create the main stream mobile platform in the bootloader exists in the code test and the DOS of the security gap. Workshop staff with a BootStomp to create 6 new found cracks, 5 of which division is the manufacturer to confirm. There is also a su XI reported...

Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin)

Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link:...

Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin)

Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html Demo: http://dijiteol.com/demos/advertiz/...

The four mainstream Android phone manufacturers the BootLoader in the presence of multiple flaws vulnerability-vulnerability warning-the black bar safety net

University of California, Santa Barbara 9 the researchers found that the four mainstream chip manufacturers of the Android bootloader component the presence of multiple vulnerabilities. These vulnerabilities can lead to the phone chain of trust during the boot process is compromised, so that the...

RedSnarf - A Pen-Testing / Red-Teaming Tool For Windows Environments

RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers using OpSec Safe Techniques. RedSnarf functionality includes: Retrieval of local SAM hashes Enumeration of user/s running with elevated syste...

Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass

An October 2015 piece published here about the potential dangers of tossing out or posting online your airline boarding pass remains one of the most-read stories on this site. One reason may be that the advice remains timely and relevant: A talk recently given at a Czech security conference...

Amazon Linux AMI : graphite2 (ALAS-2017-872)

Vulnerabilities in the Graphite 2 library MFSA 2017-16 A heap-based buffer overflow flaw related to 'lz4::decompress' has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code. CVE-2017-7778 Heap-buffer-overflow write...

The high-pass encryption and decryption engine to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

CVE-2016-3935 and CVE-2016-6738 we found that the high-pass encryption and decryption engine Qualcomm crypto engine two mention the right vulnerability, respectively, in 2016, 10 months, and 11 on the Google android vulnerabilities list is publicly acknowledged, while the high-pass also in 2016,...