CVE-2019-7313

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

CVE-2019-7313

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

CVE-2019-3912

An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites...

Open redirect

An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites...

The vulnerability of the Advanced UI interface of Oracle WebCenter Sites applications allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Advanced UI interface of Oracle WebCenter Sites for online user services is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

WordPress Yeloni Free Exit Popup 8.1.9 SQL Injection

Exploit Title : WordPress Yeloni Free Exit Popup Plugins 8.1.9 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/01/2019 Vendor Homepage : yeloni.com Software Download Link : downloads.wordpress.org/plugin/yeloni-free-exit-popup.zip Software...

Joomla RSFirewall 2.11.25 Database Disclosure

Exploit Title : Joomla RSFirewall Components 2.11.25 Database and Password Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/01/2019 Vendor Homepage : rsjoomla.com Software Download Link : extensions.joomla.org/extension/rsfirewall/ Software...

U.S. Dept Of Defense: https://████████ Impacted by DNN ImageHandler SSRF

Summary: https://███████ runs DNN 8.0.0 to 9.1.1 and is impacted by CVE 2017-0929 allowing for a SSRF through the DNN ImageHandler. Origin servers will request any image file supplied by the attacker. This allows for internal NIPR sites to be mapped and accessed through a vulnerable host. The...

Ukrainian Police Arrest 6 Hackers Linked to DDoS and Financial Attacks

Ukrainian Police have this week busted out two separate groups of hackers involved in carrying out DDoS attacks against news agencies and stealing money from Ukrainian citizens, respectively. According to the authorities, the four suspected hackers they arrested last week, all aged from 26 to 30...

Hackers infect e-commerce sites by compromising their advertising partner

Magecart strikes again, one of the most notorious hacking groups specializes in stealing credit card details from poorly-secured e-commerce websites. According to security researchers from RiskIQ and Trend Micro, cybercriminals of a new subgroup of Magecart, labeled as "Magecart Group 12," recent...

WordPress Category Page Icons 3.6.1 CSRF / Shell Upload

Exploit Title : WordPress category-page-icons Plugins 3.6.1 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 17/01/2019 Vendor Homepage : wordpress.org wp-premiumplugins.com/category-page-icons/ wordpress.org/plugins/category-page-icons/ Softwar...

Eobot: Secure Pages Include Mixed Content Issue

Description The page includes mixed content, that is content accessed via HTTP instead of HTTPS. Steps 1 Enter these two URLs https://www.eobot.com/fee https://www.eobot.com/ad 2 Open Source Code viewer You will note and Mixed Content Error. http://bitcoin.sipa.be/speed-small-lin.png Fix A page...

Ring Security Cam Snooping, Location Tracking, and More Security News This Week

A German hack confession, unencrypted government sites, and more security news this week...

The vulnerability of the Microsoft Lync for Mac instant messaging program, related to message processing errors, allows a hacker to redirect users to malicious websites or automatically download certain types of files from a list of safe file types.

The vulnerability of the Microsoft Lync for Mac instant messaging program exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to redirect users to malicious websites or automatically download certain file types as safe files through a...

CVE-2018-16174

Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Open redirect

Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Typo3 CMS YAG Themepack jQuery 1.3.2 Database Disclosure

Exploit Title : Typo3 CMS YAG Themepack jQuery Extension 1.3.2 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org yag-gallery.de Software Download Link :...

Typo3 CMS pw_highslide_gallery 0.3.1 Database Disclosure

Exploit Title : Typo3 CMS pwhighslidegallery Extension 0.3.1 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org Software Download Link : extensions.typo3.org/extension/download/pwhighslidegallery/0.3.1/zip/...

Authorities seize 15 popular DDoS-for-hire websites

By Waqas Authorities have seized and shut down 15 popular DDoS-for-hire websites used by cybercriminals for revenge and DDoS distributed denial of service attacks on private individuals as well as businesses including online gaming giants, email service providers and hosting sites. The operation...

FBI Denies Service to 15 DDoS-for-Hire Sites, Charges Operators

The Justice Department has taken 15 internet domains associated with DDoS-for-hire services offline, and has filed charges against three defendants who allegedly ran them. DDoS for hire or DDoS-as-a-service operations make it simple for any layperson to carry out DDoS attacks, flooding targets wi...