HackerOne: GIF flooding

Current limits --------------------- Image size: 1 MB Image dimensions: 2048x2048px File types: jpg/png/gif Another image hack --------------------- A GIF composed of 40k 1x1 images made Paperclip freeze until timeout. As attachments I sent the file composed of 40k images, and a screenshot of the...

OSX Screen Capture

This module takes screenshots of target desktop and automatically downloads them. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OSX Screen Capture', 'Description' = %q This module takes...

Mozilla Firefox Information Disclosure Vulnerability - Mac OS X

Mozilla Firefox is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-1729

The WebGL implementation in Mozilla Firefox before 24.0, when NVIDIA graphics drivers are used on Mac OS X, allows remote attackers to obtain desktop-screenshot data by reading from a CANVAS element...

Design/Logic Flaw

The WebGL implementation in Mozilla Firefox before 24.0, when NVIDIA graphics drivers are used on Mac OS X, allows remote attackers to obtain desktop-screenshot data by reading from a CANVAS element...

Debian DSA-2724-1 : chromium-browser - several vulnerabilities

Several vulnerabilities have been discovered in the Chromium web browser. - CVE-2013-2853 The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n carriage return, newline, carriage return, newline. - CVE-2013-2867 Chrome does not properly prevent pop-under windows. -...

Roundcube Webmail 0.9.2 Cross Site Scripting

Roundcube Webmail 0.9.2 XSS Vulnerability ======================================================== Site: http://www.roundcube.net Discovered by: Andrea Menin base64 @: bWVuaW4uYW5kcmVhQGdtYWlsLmNvbQ== Follow me: http://www.linkedin.com/in/andreamenin...

CVE-2013-2876

Removed by vendor...

Feedly.com Cross Site Scripting

Feedly.com HTML Injection and XSS Vulnerability RSS feed ======================================================== Site: http://feedly.com Discovered by: Andrea Menin base64 @: bWVuaW4uYW5kcmVhQGdtYWlsLmNvbQ== Follow me: http://www.linkedin.com/in/andreamenin...

XML-Sitemaps.com Sitemap Generator 6.0 Cross Site Scripting

XML-Sitemaps.com Sitemap Generator Date: 2nd July 2013 Author: Christy Philip Mathew www.offcon.org Vendor or Software Link: http://www.xml-sitemaps.com/generator-demo/ Version : 6.0 XSS Vulnerability a Configuration Miscellaneous Settings Send email notifications: Update the email to [email protected]" b...

Vatican Cross Site Scripting

vaticanstate.va XSS Vulnerability webcam page ======================================================== Site: http://www.vaticanstate.va/IT/Monumenti/webcam/index?cam=webcam3 Discovered by: Andrea Menin base64 @: bWVuaW4uYW5kcmVhQGdtYWlsLmNvbQ== Follow me: http://www.linkedin.com/in/andreamenin...

X Server Unauthenticated Access: Screenshot

Binary data xserverscreenshot.nbin...

VNC Server Unauthenticated Access: Screenshot

Binary data vncscreenshot.nbin...

Remote web server screenshot

This Plugin has been deprecated as service will be no longer available. Binary data httpscreenshot.nbin...

Another iPhone Passcode Bypass Vulnerability Discovered

It’s getting hard to keep track of all the bugs piling up for Apple’s iPhone. Now it seems a glitch in the iOS kernel of Apple’s much maligned iOS 6.1 is responsible for yet another passcode bypass vulnerability, the second to surface this month. Attackers can apparently access users’ photos,...

MD Webmarketing Cross Site Scripting / SQL Injection

Exploit Title : MD-WEBMARKETING - SQL Injection/Cross Site Scripting Vulnerabilities Date : 06-11-2012 Author : Caleb Bucker Independent Security Researcher Contact : https://twitter.com/CalebDrugs Website : www.calebbucker.blogspot.com Vendor : MD Webmarketing URL Vendor :...

Joomla Component com_fabrik File Upload Vulnerability

Exploit for php platform in category web applications $ $ +================================================= ================+ | Joomla Component comFabrik Remote Shell Upload Vulnerability | +================================================= ================+ Google Dork :...

Thinksns microblogging system injection vulnerability a gold-bug warning-the black bar safety net

Author: Liuker Blog: www.2bhack.net I recently nothing to do Don't ask me how the audit of the color of the pen don't know what is audit? Visually it is a few friends have seen me audit the code time to give them a screenshot Just get some. In a few days and then engage in several section of the...

UI Randomization, Statistical Analysis Could End Clickjacking

A PayPal researcher argues in a new paper that a combination of randomized user interfaces and back end screenshot comparison tools could effectively put an end to clickjacking attacks, one of the most prevalent online scams. Brad Hill of Paypal argues in a new paper for a method he calls “adapti...

VMWare Enumerate Virtual Machines

This module attempts to discover virtual machines on any VMWare instance running the web interface. This would include ESX/ESXi and VMWare Server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...