CVE-2016-3225

creationtimestamp| type| source ---|---|--- 2018-10-04 22:03:27+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms16075reflection.rb 2018-10-06 16:37:35+00:00| published-proof-of-concept| https://t.me/VulnerabilityNews/2140 2018-10-08...

How the Kavanaugh Information War Mirrors Real Warzones

Opinion: From using open source intelligence to spreading false reports to brazenly rewriting history, social media warriors on both sides of the controversy are taking a page from Russia...

Excerpts from: Using the ATT&CK™ Framework to Mature Your Threat Hunting Program

Every threat hunt starts with intelligence. As one of the industry’s most comprehensive knowledge bases for adversary behavior, ATT&CK provides a structure for hunters to build their hypotheses and search for threats. Recently Carbon Black, Red Canary and MITRE teamed up for the webinar, Using th...

HackerOne: Hacker can request mediation for published reports

Hi team, @jobert Summary: After creating the publish report, we do not have a field to send the requested meditation from HackerOne Support Description: Steps To Reproduce 1. Create publish report for any program ████████ 2. Use query https://hackerone.com/reports/numberpublishreport/hackerhelp M...

Vanilla: Abusing "Report as abuse" functionality to delete any user's post.

Hi Team, Greetings!! Description: I would like to report a vulnerability that can be used to delete any user’s post by abusing “Report an abuse” function within application. After specific number of reports submitted to server, it automatically deletes that post of user. Application has...

Stable Channel Update for Desktop

The stable channel has been updated to 69.0.3497.92 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictio...

ProConf Information Disclosure Vulnerability

ProConf is a conference management system. An information disclosure vulnerability exists in ProConf versions prior to 6.1. An attacker can exploit the vulnerability by changing the value of the Paper ID to view or gain access to submitted reports titles and abstracts and authors' personal...

CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

Datasploit - An OSINT Framework To Perform Various Recon Techniques On Companies, People, Phone Number, Bitcoin Addresses, Etc., Aggregate All The Raw Data, And Give Data In Multiple Formats

Overview of the tool: Performs OSINT on a domain/email/username/phone and find out information from different sources. Correlate and collaborate the results, show them in a consolidated manner. Tries to find out credentials, api-keys, tokens, subdomains, domain history, legacy portals, etc. relat...

On Becoming a Contributor to the HTTP Archive

The HTTP Archive is an open source project that tracks how the web is built. Twice a month it crawls 1.3 million web pages on desktop and emulated mobile devices, and collects technical information about each of the web pages. That information is then aggregated and made available in curated...

CVE-2018-11776

creationtimestamp| type| source ---|---|--- 2018-08-22 16:34:28+00:00| seen| https://t.me/thehackernews/53 2018-08-22 18:43:51+00:00| seen| https://t.me/informationsecuritychannel/19633 2018-08-22 21:14:39+00:00| published-proof-of-concept| https://t.me/canyoupwnme/4283 2018-08-22 23:58:11+00:00|...

Widespread Instagram Hack Locking Users Out of Their Accounts

Instagram has been hit by a widespread hacking campaign that appears to stem from Russia and have affected hundreds of users over the past week, leaving them locked out of their accounts. A growing number of Instagram users are taking to social media, including Twitter and Reddit, to report a...

JoomScan 0.0.6 - OWASP Joomla Vulnerability Scanner Project

OWASP Joomla! Vulnerability Scanner JoomScan is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. Implemented in Perl, this tool enables seamless and effortless scanning of Joomla installations,...

Qualys Cloud Platform (VM, SCA, PC) 8.15 New Features

This new release of the Qualys Cloud Platform VM, SCA, PC, version 8.15, includes several new improvements across the VM, PC, and SCA Apps including new IPv6 configuration options for the scanner, improvements to several VM reports including ability to display EC2 metadata, a new Policy Complianc...

SecurityCenter Cross-Site Scripting Vulnerability

Tenable SecurityCenter is a Nessus-inclusive vulnerability management platform from US-based Tenable Network Security. The platform simplifies vulnerability scanning, management and reporting and provides a console to manage policies, alerts, reports and plug-ins for Nessus. A cross-site scriptin...

CVE-2018-1155

In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...

CVE-2018-1155

In SecurityCenter versions prior to 5.7.0, a cross-site scripting XSS issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue...

Adventures in vulnerability reporting

Posted by Natalie Silvanovich, Project Zero At Project Zero, we spend a lot of time reporting security bugs to vendors. Most of the time, this is a fairly straightforward process, but we occasionally encounter challenges getting information about vulnerabilities into the hands of vendors. Since i...