710 matches found
nscs.postech.ac.kr Cross Site Scripting vulnerability OBB-1360439
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Meow Attack: A Reminder for Organizations to Identify and Secure Their Databases
Thousands of unsecured internet-facing databases have fallen prey to the “Meow” attack and have been permanently destroyed. Meow attacks replace the original index with a newly created one with the suffix “-meow”. With no ransomware demands or any other explanatory note, the attackers seem to hav...
Juniper Gather Device General Information
This module collects a Juniper ScreenOS and JunOS device information and configuration. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Juniper Gather Device General Information', 'Description'...
h1-ctf: [H1-2006 2020] [CTF Writeup] A story about Bounty Payments, Collaboration & Community
H1-2006 CTF Writeup This is a story about both solving a CTF and, most importantly, on how to make friends during the journey and learn a lot a valuable things for the future. On a Friday evening I saw this tweet from HackerOne: F853545 Honestly, last CTF was really hard so I didn't really though...
xt:Commerce 5.4.1 / 6.2.1 / 6.2.2 Improper Access Control
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-012 Product: xt:Commerce Manufacturer: xt:Commerce GmbH Affected Versions: 5.4.1, 6.2.1, 6.2.2 Tested Versions: 5.4.1, 6.2.1 Vulnerability Type: Improper Access Control CWE-284 Risk Level: Medium Solution Status: Fixed...
masoemuniversity.ac.id Cross Site Scripting vulnerability OBB-1147135
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-2897 vulnerabilities
Vulnerabilities for packages: mysql...
metasploit-framework
This is an offensive tool for Metasploit Framework. It is a collection of Ruby code that provides a framework for developing and executing exploits, as well as a platform for testing and validating vulnerabilities. The repository contains a wide range of modules and tools for various tasks,...
AppTrana Offers Protection to Online Businesses During Coronavirus Outbreak
These are unprecedented times, and everyone is going through a testing period, with more than 3 billion people locked down all over the world. Businesses are scrambling to stay afloat and are forced to move digital in a very short span of time without much preparation. As these businesses move...
Automated and Scalable Audit Workflows with Qualys Security Assessment Questionnaire
Risk and compliance management is a multi-faceted domain with concentrated endeavors towards reducing unacceptable risk potential that could disrupt business, or otherwise negatively impact business performance. IT GRC Governance, Risk and Compliance comprises many tasks related to business and I...
Command Execution Vulnerability in the ns***.php File of the Green Alliance Remote Security Evaluation System
RSAS Remote Security Assessment System is a new generation of vulnerability management product independently developed by Green Alliance Technology. A command execution vulnerability exists in the ns.php file of Remote Security Assessment System. An attacker can exploit the vulnerability to execu...
UPDATE: Prowler 2.2.0
Prowler 2.2.0 was released a couple of days ago. A lot has changed my last post about this AWS CIS Benchmark tool. This new incorporates more than 130 checks, many cool new features such as support for FreeBSD, lots of improvements and fixes in documentation and code! What is Prowler? Prowler is ...
Kernel-mode type-confusion vulnerability via NtUserSetInformationThread/UserThreadCsrApiPort
The Windows Kernel is subject to a kernel-mode type-confusion vulnerability inside win32k!NtUserSetInformationThread due to referencing a user-mode handle via ObReferenceObjectByHandle with a NULL type specified it should instead be using LpcPortObjectType to protect against this vulnerability...
Download: 2019 Security Team Assessment Template
As a security professional, it is critical that you assess the performance of your security team and keep in-the-know regarding your current security posture, in addition to planning ahead. ‘The Ultimate 2019 Security Team Assessment Template‘ is a first-of-its-kind tool that encapsulates all the...
Download: The Comprehensive Compliance Guide
A large part of the CISO/CIO responsibility is ensuring compliance standards are met. As one of the main drivers of security product purchase and implementation, regulation comes in many different shapes and sizes. Some standards provide clear consequences for failure to meet them. Others provide...
Lockdoor Framework - A Penetration Testing Framework With Cyber Security Resources
Lockdoor Framework : A Penetration Testing Framework With Cyber Security Resources. 09/2019 : 1.0Beta Information Gathring Tools 21 Web Hacking Tools15 Reverse Engineering Tools 15 Exploitation Tools 6 Pentesting & Security Assessment Findings Report Templates 6 Password Attack Tools 4 Shell Tool...
Beyond The Standard CISO Cloud Security Guide
Verizon recently released a 5 step process for evaluating cloud security products and services to inform purchase decisions. That’s a fantastic tool for buyers to have. This is especially helpful because cloud discussions are almost always driven by business objectives to satisfy a cost and or...
Counter-Strike Global Offensive 1.37.1.1 - vphysics.dll Denial of Service (PoC)
Counter-Strike Global Offensive 1.37.1.1 - vphysics.dll Denial of Service PoC CVE-2019-15943 Counter-Strike Global Offensive vphysics.dll before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, becaus...
ActiveReign - A Network Enumeration And Attack Toolset
Background A while back I was challenged to write a discovery tool with Python3 that could automate the process of finding sensitive information on network file shares. After writing the entire tool with pysmb, and adding features such as the ability to open and scan docx an xlsx files, I slowly...
TGI Fridays Delivers Customer Indigestion Over Data Exposure
Customers of TGI Fridays Australia were “strongly recommended” to change their MyFridays membership rewards program passwords. According to an email sent to customers this week, the company had inadvertently left sensitive loyalty program data exposed on the internet. News of the leaky server...