Word Attachment Delivers FormBook Malware, No Macros Required

A new wave of document attacks targeting inboxes do not require enabling macros in order for adversaries to trigger an infection chain that ultimately delivers FormBook malware. Researchers at Menlo Security are reporting a wave of attacks that began last month that are targeting financial and...

MyBB Plugin Recent Threads On Index - Cross-Site Scripting

MyBB Plugin Recent Threads On Index - Cross-Site Scripting Exploit Title: MyBB Recent threads Date: 4th April 2018 Exploit Author: Perileos Software Link: https://community.mybb.com/mods.php?action=view&pid=191 Version: 17.0 Tested on: Windows 10 1. Description: This plugin shows recent threads i...

MyBB Recent Threads On Index 17.0 Cross Site Scripting

Exploit Title: MyBB Recent threads Date: 4th April 2018 Exploit Author: Perileos Software Link: https://community.mybb.com/mods.php?action=view&pid=191 Version: 17.0 Tested on: Windows 10 1. Description: This plugin shows recent threads in the side bar on your MyBB forum. 2. Proof of concept:...

MyBB Recent Threads On Index Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Recent threads Exploit Author: Perileos Software Link: https://community.mybb.com/mods.php?action=view&pid=191 Version: 17.0 Tested on: Windows 10 1. Description: This plugin shows recent threads in the side bar on your MyB...

MyBB Plugin Recent Threads On Index - Cross-Site Scripting

Exploit Title: MyBB Recent threads Date: 4th April 2018 Exploit Author: Perileos Software Link: https://community.mybb.com/mods.php?action=view&pid=191 Version: 17.0 Tested on: Windows 10 1. Description: This plugin shows recent threads in the side bar on your MyBB forum. 2. Proof of concept:...

Microsoft Office Vulnerabilities Used to Distribute Zyklon Malware in Recent Campaign

Introduction FireEye researchers recently observed threat actors leveraging relatively new vulnerabilities in Microsoft Office to spread Zyklon HTTP malware. Zyklon has been observed in the wild since early 2016 and provides myriad sophisticated capabilities. Zyklon is a publicly available,...

Security Vulnerability in Apple's HomeKit

The story of the recent vulnerability in Apple's HomeKit...

The Time Has Arrived to Embrace Hackers

BOSTON—More than ever, hackers are getting a welcoming embrace from law enforcement, governments and business. Bug bounties and vulnerability disclosure programs are becoming the norm across industry, and hackers are no longer universally viewed as a pariah. Simultaneously, however, groups such a...

CVE-2017-7576

DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials such as the username of energetic and password of wireless meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. This is fixed in...

shopify-scripts: Null pointer dereferences in ary_concat

@ssarong reported a null pointer dereference in MRuby: https://github.com/mruby/mruby/issues/3532 The issue was corrected in https://github.com/mruby/mruby/commit/d35fcf1ea2bfc3933b2f2543265874669feeee95...

Open Databases a Juicy Extortion Target

Recent attacks against insecure MongoDB, Hadoop and CouchDB installations represent a new phase in online extortion, born from ransomware’s roots with the promise of becoming a nemesis for years to come. “These types of attacks have grown from ones of opportunity to full-scale automated and...

U.S. Dept Of Defense: Open FTP server on a DoD system

Summary: I don't know if this qualifies but during my search I discovered an open FTP panel that I was able to successfully log into. Using any FTP program, I used File zilla and then entered ████ as my host then connected. Then I was able to look through any of the files. I noticed the last...

packers.com XSS vulnerability

Vulnerable URL: http://www.packers.com/media-center/recent-podcast.html?month="-alertOPENBUGBOUNTY-" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 22776 VIP website status:| Yes...

Wordpress recent-backups plugin file download vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language. recent-backups is one of the version of the back plugin. A file download vulnerability exists in version v0.7 of the Wordpress recent-backups plugin, which can be exploited by remote...

CVE-2015-1000006

Remote file download vulnerability in recent-backups v0.7 wordpress plugin...

Remote file inclusion

Remote file download vulnerability in recent-backups v0.7 wordpress plugin...

CVE-2015-1000006

CVE-2015-1000006 corresponds to a remote file download vulnerability in the WordPress plugin recent-backups v0.7. Connected sources confirm a file‑download flaw in the plugin, with OpenVAS and WPVulnDB noting directory traversal/file download risk and WPEX exploit notes that download-file.php doe...

LHF (Low Hanging Fruit) - A Modular Recon Tool For Pentesting

To install dependencies: ./Install.sh To start: ./LHF.py + Checking permissions - Rockyou wordlist is missing trying to decompress... + Rockyou wordlist is decompressed! - Please enter the ip to scan example 192.168.0.1 or www.target.com : A "results" folder will be created after inputting the...

Direct3D Recent Program

Nessus was able to query the registry to find the most recent program to use Direct3D for each user on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92417; scriptversion"1.6"; scriptcvsdate"Date: 2018/11/15 20:50:27";...

CVE-2016-4971

creationtimestamp| type| source ---|---|--- 2016-07-06 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40064 2021-04-30 16:26:41+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/283 2024-11-14 06:08:59+00:00| seen| MISP/e8de7faf-a595-4c5b-bcd7-ecddfbfa56af...