PeteReport Cross-Site Request Forgery Vulnerability

PeTeReport is an open source application vulnerability reporting tool. Designed to assist penetration testing/red team efforts by simplifying the task of report writing and generation, PeTeReport suffers from a cross-site request forgery vulnerability that could be exploited by attackers to trick...

The Top 5 Russian Cyber Threat Actors to Watch

This post was updated on March 10, 2022 to include a section on the Conti Ransomware Group. As we continue to monitor the situation between Russia and Ukraine – and the potential for global cybersecurity impacts – we realize that our customers and other business and industry stakeholders may be...

CVE-2022-23656

Zulip Server (main branch, from June 2021 onward) is vulnerable to a cross-site scripting (XSS) issue on the recent topics page. The vulnerability arises from insufficient validation of client-side data, allowing an attacker to craft a malicious full name and trigger JavaScript execution when a v...

Research reveals cyber risk is the best language for a C-suite audience

As a Chief Information Security Officer CISO or cybersecurity leader, one of the most important parts of your role is to manage the organizations cybersecurity risk. Managing risk and minimizing the impact of cyber incidents strengthens trust between you and the executive team, which is essential...

Uber: Uber Test Report 20220301

Test summary from Team Uber. This is the summary from secret John. This is the edit from hacker John after disclosure was approved. Second test after disclosure...

Security Notice: NVIDIA Response to Security Incident - March 2022

Go to NVIDIA Product Security. Update March 8, 2022: The two NVIDIA code-signing certificates that were reported to be leaked in this cybersecurity incident are expired: subject CN: NVIDIA Corporation issuer CN: VeriSign Class 3 Code Signing 2010 CA serial: 43bb437d609866286dd839e1d00309f5 valid...

JetBrains Hub has an unspecified vulnerability (CNVD-2022-17757)

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together.A security vulnerability exists in versions prior to JetBrains Hub 2022.1.14434, which stems from allowing SAML requests to take over. No detail...

WordPress WordPress Team Members – GS Plugins plugin <= 1.10.18 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Team Members – GS Plugins plugin versions = 1.10.18. Solution Update the WordPress WordPress Team Members – GS Plugins plugin to the latest available version at least 1.11.0...

WordPress WordPress Team Members – GS Plugins plugin <= 1.10.18 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordPress Team Members – GS Plugins plugin versions = 1.10.18. Solution Update the WordPress WordPress Team Members – GS Plugins plugin to the latest available version at least 1.11.0...

WordPress Ant Admin Notices for Team plugin <= 1.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ant Admin Notices for Team plugin versions = 1.0.4. Solution No patched version available...

CVE-2022-0708

Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure...

Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. https://example.com/wp-admin/admin.php?page=circlethumbnailsliderwithlightboximagemanagement&orderpos=...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from the inability of Mattermost 6.3.0 and earlier versions to protect the team creator's email address via one of the APIs, which can be...

SSRFire - An Automated SSRF Finder. Just Give The Domain Name And Your Server And Chill! Also Has Options To Find XSS And Open Redirects

An automated SSRF finder. Just give the domain name and your server and chill! ; It also has options to find XSS and open redirects. Syntax ./ssrfire.sh -d domain.com -s yourserver.com -f customfile.txt -c cookies domain.com --- The domain for which you want to test yourserver.com --- Your server...

Justice Department Appoints First Director of National Cryptocurrency Enforcement Team

The U.S. Department of Justice DoJ earlier this week appointed Eun Young Choi to serve as the first Director of the National Cryptocurrency Enforcement Team NCET it established last year. The NCET was created to tackle the criminal misuse of cryptocurrencies and digital assets," with a focus on...

WordPress dzs-zoomsounds 6.60 Shell Upload

Exploit Title: WordPress Plugin dzs-zoomsounds - Remote Code Execution RCE Unauthenticated Google Dork: inurl:wp-content/plugins/dzs-zoomsounds Date: 16/02/2022 Exploit Author: Overthinker1877 1877 Team Vendor Homepage: https://digitalzoomstudio.net/docs/wpzoomsounds/ Version: 6.60 Tested on:...

Macrome - Excel Macro Document Reader/Writer For Red Teamers And Analysts

An Excel Macro Document Reader/Writer for Red Teamers & Analysts. Blog posts describing what this tool actually does can be found here and here. Installation / Building Clone or download this repository, the tool can then be executed using dotnet - for example: dotnet run -- build --decoy-documen...

Stored Cross-site Scripting vulnerability in Jenkins Team Views Plugin

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

GHSA-MV5C-724F-3FQ7 Stored Cross-site Scripting vulnerability in Jenkins Team Views Plugin

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

CVE-2022-25203

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...