524 matches found
Square: malicious file upload
i found my payload on exif header and it works link https://www.bookfresh.com/upload/75084df285f94f6790a250fe516fef04test.php.jpg...
Square: Reflected XSS in widget script thru cookie
There is buyerinfo cookie. Let set it to this value: a:9:s:10:"firstname";s:47:""xss...
Square: Reflected XSS in connect.square.com
Hi! The page at https://connect.squareup.com/sessions/new doesn't properly sanitize the "email" parameter and/or the input field for email. Since the site is built with AngularJS and the email field is a binded field child of ng-app, we can inject an AngularJS template. Normally, you aren't...
Square: Editing Client Details of other People
Hi there, I have found out that there is no "authorization" in which prohibits a user to modify client's data of other users. As per sample I have two2 accounts: One freebie account and One subscribed account Monthly The freebie account has a Client with ID : f42b88d1af62f0a9d240024e83690174. Tha...
Square: CRITICAL Account takeover via AngularJS template injection in connect.squareup.com
Hi! The OAUTH prompt at https://connect.squareup.com/oauth2/authorize?clientid=EXAMPLE prints out the current OAUTH appname without sanitizing it from -style AngularJS templates. This makes it possible for an attacker to add an AngularJS template to his/her appname that calls the $scope.allow...
Square Launches Bug Bounty, Hires Top Security Researcher
The bug bounty phenomenon began mainly with major software vendors and security companies, which were the main targets for security researchers and attackers. But it is now moving to virtually every corner of the Web and software ecosystem, and the latest company to join the party is Square, the...
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...
CVE-2013-5036
The CVE-2013-5036 issue pertains to Square Squash’s YAML processing, allowing remote code execution via a YAML document in (1) the namespace parameter to the deobfuscation function or (2) the sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb. Connected advisori...
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...
Square 0.3.1 Cross Site Scripting
Exploit Title: Square 0.3.1 XSS Vulnerability Date: 2014 17 March Author: Dr.3v1l Vendor Homepage: http://readmoresystems.com Version : 0.3.1 Tested on: Windows Category: webapps Google Dork: inurl:"/?s=" + Exploit : http:///square.0.3.1/0.3.1/?s=XSS&submit=Submit&cmd=search + Demo : You can find...
[SECURITY] Fedora 18 Update: kreversi-4.10.5-1.fc18
Kreversi is a simple one player strategy game played against the computer. The playing field is an 8 by 8 square board divided into 64 squares. The game pieces used are two sided stones, where each side has its own, distinctive color. If a piece is captured by an opposing player, that piece is...
[SECURITY] Fedora 18 Update: kjumpingcube-4.10.5-1.fc18
KJumpingCube is a simple tactical game. You can play it against the computer or a friend. The playing area consists of squares containing points. When t he game starts each square has only one point, and no owner. Players move by clicking on either a vacant square or one of their own squares, thu...
California issued cease and desist order against Bitcoin Foundation
The Bitcoin Foundation has received a cease-and-desist letter from the California Department of Financial Institutions, which oversees banks, credit unions, and other financial organizations operating in the state. Jon Matonis, who is a board member at the Foundation, revealed the letter on Forbe...
California issued cease and desist order against Bitcoin Foundation
The Bitcoin Foundation has received a cease-and-desist letter from the California Department of Financial Institutions, which oversees banks, credit unions, and other financial organizations operating in the state. Jon Matonis, who is a board member at the Foundation, revealed the letter on Forbe...
Design/Logic Flaw
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service condorschedd restart via square brackets in the cproc option...
PT-2013-1675 · Red Hat · Condor
Name of the Vulnerable Software and Affected Versions: Condor versions in Red Hat Enterprise MRG 2.3 Description: The issue allows remote attackers to cause a denial of service, resulting in a condor schedd restart, by utilizing square brackets in the cproc option when removing a job. This is due...
condor: DoS when removing jobs via jobcontrol.py when job id is in square brackets
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service condorschedd restart via square brackets in the cproc option...
condor: DoS when removing jobs via jobcontrol.py when job id is in square brackets
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service condorschedd restart via square brackets in the cproc option...
php: $_FILES array indexes corruption
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid open square bracket characters in name values, which makes it easier for remote attackers to cause a denial of service malformed $FILES indexes or conduct directory traversal attacks during multi-file...
December 2011 – Square Enix / Trion Worlds
Two minor data breaches affected video game developers Square Enix Final Fantasy and Trion Worlds Rift late last year, allegedly spilling sensitive information from the company’s servers. The attack against Square Enix hit 1.8 million users – mostly North American and Japanese customers who signe...