NSA Morale

The Washington Post is reporting that poor morale at the NSA is causing a significant talent shortage. A November New York Times article said much the same thing. The articles point to many factors: the recent reorganization, low pay, and the various leaks. I have been saying for a while that the...

thannam.net XSS vulnerability

Open Bug Bounty ID: OBB-440106 Description| Value ---|--- Affected Website:| thannam.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

SQL Injection Vulnerability in check_need_status, check_pay_sum Methods of WK+shop General Mall System

WK+shop is a mall system based on the technology of PHP+MySQL, developed using ThinkPHP5.0 framework, which combines the Witcott mission system with multiple mall systems. WK+shop general mall system checkneedstatus, checkpaysum method SQL injection vulnerability, attackers can construct a specif...

WordPress Post Pay Counter plugin <= 2.730 - Authenticated PHP Object Injection Vulnerability

WordPress Post Pay Counter plugin Authenticated PHP Object Injection Vulnerability was fond in 2.730 version. WordPress Post Pay Counter Plugin should have made sure the user is intended to be able to import settings by checking if their user role is one permitted to access the page. Solution...

Pay Banner Text Link Ad 1.0.6.1 Cross Site Request Forgery

Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html Demo:...

Pay Banner Text Link Ad 1.0.6.1 SQL Injection

Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - SQL Injection Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html Demo: http://dijiteol.com/demos/pbtla Version: 1.0.6.1...

Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin)

Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html Demo:...

Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link:...

Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin)

Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery Update Admin Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link:...

Pay Banner Text Link Ad 1.0.6.1 - SQL Injection

Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - SQL Injection Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html Demo: http://dijiteol.com/demos/pbtla Version: 1.0.6.1...

FAQ: Citrix ADC on Microsoft Azure

Q: What is Citrix ADC, formerly Netscaler ADC, on Microsoft Azure? A: Citrix ACD on Microsoft Azure is a L4-L7 virtual networking appliance that ensures organizations have access to secure and optimized applications and assets deployed in the cloud. Citrix ADC on Azure provides a foundation for t...

Carbon Emissions: Oversharing Bug Puts Security Vendor Back in Spotlight

Last week, security firm DirectDefense came under fire for over-hyping claims that Cb Response, a cybersecurity product sold by competitor Carbon Black, was leaking proprietary data from customers who use it. Carbon Black responded that the bug identified by its competitor was a feature, and that...

Hacker Publishes iOS Secure Enclave Firmware Decryption Key

A hacker Thursday afternoon published what he says is the decryption key for Apple iOS’ Secure Enclave Processor SEP firmware. The hacker, identified only as xerub, told Threatpost that the key unlocks only the SEP firmware, and that this would not impact user data. “Everybody can look and poke a...

What to Consider When Choosing a Security Vendor

Picking a security vendor for your managed service business should be about business model alignment, not product cost. If you’re a seasoned managed service provider MSP, you are already very familiar with the benefits of the pay-as-you-go business model. In fact, it’s most likely how you sell yo...

niushop_b2c Pay.php has xml entity injection vulnerability

Niushop open source mall National first commercial free four-in-one completely open source 100% open source The country's first set of B2B2C multi-user mall + micro letter micro-distribution + e-commerce platform investment operation + iOS, Android multi-platform client PHP open source e-commerce...

ianpayrealestate.ca XSS vulnerability

Vulnerable URL: http://www.ianpayrealestate.ca/listingresults.asp Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Randstad Group Selects Trend Micro to Protect its Public Cloud Infrastructure

The Randstad Group is currently in the process of consolidating and centralizing its IT infrastructure across 30 IT departments, and will be providing service to more than 40 operating countries across four continents. To ensure the new infrastructure will have optimal security the company select...

pay-me.ir XSS vulnerability

Vulnerable URL: http://pay-me.ir/direct.php?card=5=1%22%3E%3Cscript%3Ealert%28/XSSPOSED/%29%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5554035 VIP website status:|...

Circle Pay — Send money free - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Circle Pay — Send money free published at the 'play' market has multiple vulnerabilities...

SQL injection vulnerability in the climit parameter of the admin_pay.php page of the Ocean CMS system

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS adminpay.php page. The lack of filtering of the climit parameter allows attackers to exploit the vulnerability to obtain sensitive database information...