4764 matches found
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
CVE-2018-16651
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
Datasploit - An OSINT Framework To Perform Various Recon Techniques On Companies, People, Phone Number, Bitcoin Addresses, Etc., Aggregate All The Raw Data, And Give Data In Multiple Formats
Overview of the tool: Performs OSINT on a domain/email/username/phone and find out information from different sources. Correlate and collaborate the results, show them in a consolidated manner. Tries to find out credentials, api-keys, tokens, subdomains, domain history, legacy portals, etc. relat...
On Becoming a Contributor to the HTTP Archive
The HTTP Archive is an open source project that tracks how the web is built. Twice a month it crawls 1.3 million web pages on desktop and emulated mobile devices, and collects technical information about each of the web pages. That information is then aggregated and made available in curated...
CVE-2018-11776
creationtimestamp| type| source ---|---|--- 2018-08-22 16:34:28+00:00| seen| https://t.me/thehackernews/53 2018-08-22 18:43:51+00:00| seen| https://t.me/informationsecuritychannel/19633 2018-08-22 21:14:39+00:00| published-proof-of-concept| https://t.me/canyoupwnme/4283 2018-08-22 23:58:11+00:00|...
Widespread Instagram Hack Locking Users Out of Their Accounts
Instagram has been hit by a widespread hacking campaign that appears to stem from Russia and have affected hundreds of users over the past week, leaving them locked out of their accounts. A growing number of Instagram users are taking to social media, including Twitter and Reddit, to report a...
JoomScan 0.0.6 - OWASP Joomla Vulnerability Scanner Project
OWASP Joomla! Vulnerability Scanner JoomScan is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. Implemented in Perl, this tool enables seamless and effortless scanning of Joomla installations,...
Qualys Cloud Platform (VM, SCA, PC) 8.15 New Features
This new release of the Qualys Cloud Platform VM, SCA, PC, version 8.15, includes several new improvements across the VM, PC, and SCA Apps including new IPv6 configuration options for the scanner, improvements to several VM reports including ability to display EC2 metadata, a new Policy Complianc...
SecurityCenter Cross-Site Scripting Vulnerability
Tenable SecurityCenter is a Nessus-inclusive vulnerability management platform from US-based Tenable Network Security. The platform simplifies vulnerability scanning, management and reporting and provides a console to manage policies, alerts, reports and plug-ins for Nessus. A cross-site scriptin...
CVE-2018-1155
In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...
CVE-2018-1155
In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...
Adventures in vulnerability reporting
Posted by Natalie Silvanovich, Project Zero At Project Zero, we spend a lot of time reporting security bugs to vendors. Most of the time, this is a fairly straightforward process, but we occasionally encounter challenges getting information about vulnerabilities into the hands of vendors. Since i...
Staying Safe in the Era of Browser-based Cryptocurrency Mining
Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...
CVE-2018-3014
Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications subcomponent: Reports. The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
Buffer overflow
Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications subcomponent: Reports. The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.
Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...
Design/Logic Flaw
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...
CVE-2018-2427
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...
CVE-2018-2427
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports version for Visual Studio .NET, Version 2010 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application...