Equifax Breach Response Turns Dumpster Fire

I cannot recall a previous data breach in which the breached company's public outreach and response has been so haphazard and ill-conceived as the one coming right now from big-three credit bureau Equifax, which rather clumsily announced Thursday that an intrusion jeopardized Social security...

Design/Logic Flaw

An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway ALG. Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with...

CVE-2017-2346

The CVE-2017-2346 issue affects Juniper Networks Junos OS on MX platforms, where an ALG handling of large fragmented packets can crash the MS-MPC/MS-MIC Service PIC, causing extended DoS. Impact is confined to specific Junos versions on MX hardware (e.g., 14.1X55-D30 to before 14.1X55-D35; 14.2R7...

Yelp: Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values.

Dear Yelp bug bounty team, Summary --- Firefly is vulnerable to timing attacks, because the verifyaccesstoken function performs a byte-by-byte comparison, which terminates early when two characters do not match. Timing attacks are a type of side channel attack where one can discover valuable...

pr-teh.ru XSS vulnerability

Vulnerable URL: http://pr-teh.ru/search/?query=%27%7D%7D;%22%3E%7D;%7D;%7D--%3E%3C/SCRIPT%3E-%3C/style%3E-%3C/title%3E-%3C/BoDy%3E-%3Cmarquee%3E-%3Ch1%3EOmniGooch%3C/h1%3E-%3C/marquee%3E-%3Csvg/onload=alert%27XSSPOSED%27;%3E;%7B%7B%27 Details: Description| Value ---|--- Patched:| Yes, at...

Gratipay: Content-Length restriction bypass to heap overflow in gip.rocks.

I started playing around with a0xnirudh's Content-Length restriction bypass and noticed that when combined with a different vulnerability this could be leveraged to do a bit more than DoS. We decided to open a new ticket to address this issue, since we were already aware of the bypass. a0xnirudh...

CVE-2016-9115

Heap Buffer Over-read in function imagetotga of convert.cjp2:942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file...

CVE-2016-1228

Cross-site request forgery CSRF vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the...

CVE-2016-1227: Undefined Security Weakness

NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

Multiple NTT Hikari Denwa Products OS Command Injection Vulnerabilities

The NTT Hikari Denwa PR-400MI, RV-440MI and RT-400MI are all router products from Nippon Telegraph and Telephone NTT. An operating system command injection vulnerability exists in multiple NTT Hikari Denwa products. An attacker could exploit the vulnerability to execute arbitrary operating system...

Timing Attack

Overview Affected versions of csrf-lite are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character...

Cloud Metadata URL List

Landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you havent seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I recommend it. To make life a little easier created a living URL list for Metadata broken down by cloud. There are a few more than he discusse...

Cloud Metadata URL List

Landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you haven't seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I recommend it. To make life a little easier created a living URL list for Metadata broken down by cloud. There are a few more than he discuss...

pr-cy.ru XSS vulnerability

Open Bug Bounty ID: OBB-134014 Description| Value ---|--- Affected Website:| pr-cy.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hispashare.com XSS vulnerability

Vulnerable URL: http://www.hispashare.com/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 52176 Google Pagerank| 3 VIP website status:| No Check hispashare.com SSL connection:|...

Directory Traversal

Overview Versions 0.8.3 and earlier of send are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. For...

jcrew.com XSS vulnerability

Vulnerable URL: https://www.jcrew.com/dk/womenscategory/shoes/espadrilles/PRDO"VRC5447/C5447.jsp Details: Description| Value ---|--- Patched:| Yes, at 07.11.2016 Latest check for patch:| 07.11.2016 04:40 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1611 Googl...

How I Got Here: Jennifer Leggio

Dennis Fisher talks with Jennifer Leggio, a longtime player in security PR and marketing, about her start as an obituary writer in Southern California, her move into tech in the Bay Area, what she loves about working in security and what makes for successful startups. Download: 16leggio.mp3 Music...

Ruby on Rails: JSON keys are not properly escaped

Rails does not escape hash keys properly in tojson when generating json. Values are escaped as expected ruby irbmain:001:0 "a"="".tojson = ""a":"\u003c\u003e"" However keys are not: ruby irbmain:002:0 ""="a".tojson = """:"a"" This is because the json gem calls .tos on the keys here which...

DEBIAN-CVE-2014-3690

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service system disruption by...