Cross site scripting

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

Debian DSA-3947-1 : newsbeuter - security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DLA-1061-1 : newsbeuter security update

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine. For Debian 7 'Wheezy', these problems have been fixe...

[SECURITY] [DSA 3947-1] newsbeuter security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3947-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 18, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3947-1] newsbeuter security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3947-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 18, 2017 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3947-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UPDATE: WordPress Exploit Framework v1.6.1!

PenTestIT RSS Feed Wow I seem to have missed a lot of updates lately. This time, I missed an update about WPXF. We now have the WordPress Exploit Framework v1.6.1 amongst us! This new version among other things updates a major bug that occurred while updating the framework and adds multiple new...

UPDATE: OSRFramework 0.17.0 BlackHat Arsenal Version!

PenTestIT RSS Feed Sometime early last month, I made a post about OSRFramework which was version 0.16.8. A new version of this open sources research framework was released at the recently concluded BlackHat 2017 conference. To be precise, it was released on Wednesday, July 26 in the OSINT Arsenal...

UPDATE: Luckystrike 2.0!

PenTestIT RSS Feed My first post regarding this malicious Microsoft Office document generator was about an older version. However a few hours ago, an update was released - Luckystrike 2.0! Major highlights for this awesome release include full support for Microsoft Word in addition to a new COM...

Metasploit Wrapup

Metasploit Hackathon We were happy to host the very first Metasploit framework open source hackathon this past week in the Rapid7 Austin. Eight Metasploit hackers from outside of Rapid7 joined forces with the in-house team and worked on a lot of great projects, small and large. @bcook started the...

Sensitive Information Disclosure

moodle/moodle is vulnerable to information disclosure attacks. A flaw in blog/rsslib.php continues to provide a blog RSS feed when blogging is disabled. Attackers can leverage this feed to obtain sensitive information...

Bypass Access Restrictions

Moodle is vulnerable to access restrictions being bypassed. Authenticated users can leverage the student role to bypass access restrictions and read the RSS feed for a forum. This is possible because mod/forum/rsslib.php does not correctly implement the requirement for posting before reading a Q...

Beers with Talos Podcast Now Available

The first episodes of Beers with Talos are now available on iTunes and directly on talosintelligence.com/podcasts.When Talos decided to make a threat intelligence podcast, we wanted to make it different than your typical buttoned down, subdued security podcast. The BWT crew: Craig, Joel, a...

GLSA-201702-26 : Nagios: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201702-26 Nagios: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Nagios. Please review the CVE identifiers referenced below for details. Impact : A local attacker, who either is already Nagioss system us...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Gluster Storage 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Gluster Storage 3.1 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nagios: Command injection via curl in MagpieRSS

It was found that an attacker who could control the content of an RSS feed could execute code remotely using the Nagios web interface. This flaw could be used to gain access to the remote system and in some scenarios control over the system...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Juno for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: nagios security update

An update for nagios is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 Kilo for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2017-5382

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox 51...