LibreHealth 2.0.0 File Read / File Delete / LFI

Exploit Title: LibreHealth 2.0.0 - Arbitrary File Actions Date: 2018-10-19 Exploit Author: Carlos Avila Vendor Homepage: https://librehealth.io/ Software Link: https://github.com/LibreHealthIO/lh-ehr Version: 2.0.0 Tested on: Debian LAMP, LibreHealth 2.0.0 LibreHealth is the 'fork' of the OpenEMR...

ThreatList: Despite Fraud Awareness, Password Reuse Persists for Half of U.S. Consumers

As National Fraud Day approaches Nov. 11, it remains clear that more consumer education is required when it comes to thwarting scammers and identity thieves. Despite almost half of U.S. consumers 49 percent believing their security habits make them vulnerable to information fraud or identity thef...

ffg.jeudego.org XSS vulnerability

Open Bug Bounty ID: OBB-695097 Description| Value ---|--- Affected Website:| ffg.jeudego.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

reproductive-endocrinology-infertility.imedpub.com XSS vulnerability

Open Bug Bounty ID: OBB-690426 Description| Value ---|--- Affected Website:| reproductive-endocrinology-infertility.imedpub.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site...

A Trove of Facebook Data Is a Spammer's Dream and Your Nightmare

A new report suggests that spammers, not nation states, may have been behind the Facebook hack. That could be even worse news...

malayalam.filmibeat.com XSS vulnerability

Open Bug Bounty ID: OBB-687350 Description| Value ---|--- Affected Website:| malayalam.filmibeat.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Kados R10 GreenBee - release_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Kados R10 GreenBee - 'releaseid' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.kados.info/ Software Link: https://sourceforge.net/projects/kados/ Version: R10 GreenBee Category: Webapps Tested on:...

30 Million Facebook Accounts Were Hacked: Check If You're One of Them

Late last month Facebook announced its worst-ever security breach that allowed an unknown group of hackers to steal secret access tokens for millions of accounts by taking advantage of a flaw in the 'View As' feature. At the time of the initial disclosure, Facebook estimated that the number of...

century21umi.com XSS vulnerability

Open Bug Bounty ID: OBB-683674 Description| Value ---|--- Affected Website:| century21umi.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

cbrl.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-682986 Description| Value ---|--- Affected Website:| cbrl.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

klockor4you.nu XSS vulnerability

Open Bug Bounty ID: OBB-682779 Description| Value ---|--- Affected Website:| klockor4you.nu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Hackers Exploit Facebook Bug, As Twitter DMs (Maybe) Got Misrouted

In our latest security news digest, we check out the Facebook hack heard 'round the world, a Twitter bug that rattled users but may not amount to much, and a pair of serious Linux kernel vulnerabilities. Facebook scrambles to investigate major breach affecting tens of millions of users The cyber...

Action case insensitivity

Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...

Action case insensitivity

Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...

The Facebook Security Meltdown Exposes Way More Sites Than Facebook

The social networking giant confirmed Friday that sites you use Facebook to login to could have been accessed as a result of its massive breach...

Facebook's Massive Security Breach: Everything We Know

Up to 50 million Facebook users were affected—and possibly 40 million more—when hackers compromised the social network's systems...

16-Year-Old Boy Who Hacked Apple's Private Systems Gets No Jail Time

An Australian teenager who pleaded guilty to break into Apple's private systems multiple times over several months and download some 90GB of secure files has avoided conviction and will not serve time in prison. An Australian Children's Court has given the now 19-year-old adult defendant, who was...

handironingservice.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-680524 Description| Value ---|--- Affected Website:| handironingservice.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ex-NSA Developer Gets 5.5 Years in Prison for Taking Top Secret Documents Home

A former NSA employee has been sentenced to five and a half years in prison for illegally taking a copy of highly classified documents and hacking tools to his home computer between 2010 and 2015, which were later stolen by Russian hackers. Nghia Hoang Pho, 68, of Ellicott City, Maryland—who work...

Malware on SHEIN Servers Compromises Data of 6.4M Customers

Email addresses and encrypted passwords of over 6.4 million SHEIN customers were stolen over the summer after the women’s retailer said it suffered a “concerted criminal cyberattack” on its computer network. The data breach occurred between June and August 2018, the company said in a recent...