CVE-2016-10927

CVE-2016-10927 affects the WordPress plugin nelio-ab-testing (pre-4.5.11). The vulnerability is an SSRF in ajax/iesupport.php, with CVSSv3 base score 10.0 (CRITICAL) and CVSSv2 base score 6.4 (MEDIUM). Impact indicators shown: high confidentiality and integrity impact, no availability impact; exp...

CVE-2016-10927

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php...

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

CVE-2016-10926

The CVE concerns the Nelio AB Testing WordPress plugin prior to version 4.5.9, which contains a Server-Side Request Forgery (SSRF) vulnerability in ajax/iesupport.php. Publicly documented impact indicates high risk to confidentiality and integrity (CVSS3 base score 10.0; vector: NETWORK, no privi...

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

PT-2019-7723

Name of the Vulnerable Software and Affected Versions nelio-ab-testing plugin versions prior to 4.5.11 Description The issue concerns a Server-Side Request Forgery SSRF in the ajax/iesupport.php file. Recommendations For versions prior to 4.5.11, update to version 4.5.11 or later to resolve the...

PT-2019-7722

Name of the Vulnerable Software and Affected Versions nelio-ab-testing plugin versions prior to 4.5.9 Description The issue concerns a Server-Side Request Forgery SSRF in the ajax/iesupport.php file. Recommendations For versions prior to 4.5.9, update to version 4.5.9 or later to resolve the issu...

CVE-2016-10927: Server-Side Request Forgery (SSRF)

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php...

CVE-2016-10926: Server-Side Request Forgery (SSRF)

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

When Checking the Box Results in Two Zero Days and Root (CVE-2019-14257 and CVE-2019-14258)

Finding new bugs and exploiting them can be exciting and fun for a penetration tester. I was ecstatic to find my first two zero-days, and I used them to break a system from no access to root. This was a good day for me - but the story behind the story provides some real lessons enterprises can...

Microsoft Offers $30K Rewards For Chromium Edge Beta Flaws

Microsoft is calling on researchers to help sniff out any security glitches in the beta version of its new Chromium-based Edge browser before officially pushing it live. The tech company has been working to build a new version of Edge based on Google’s open-source Chromium code, as opposed to its...

WordPress nelio-ab-testing plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nelio-ab-testing is a plugin for A/B testing of websites. A cross-site request forgery vulnerability exists in the WordPress...

Apple Sues Corellium Over iOS 'Replica' Security Testing Software

Apple has sued startup Corellium for copyright infringement, alleging that the company has developed “exact digital replicas” of its iPhone operating system without authorization – from the code down to the graphical user interface. While details about Florida-based Corellium on its website are...

CVE-2017-18547

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms...

CVE-2017-18547

The CVE concerns the WordPress Nelio Ab Testing plugin prior to version 4.6.4, where a CSRF flaw exists in the experiment forms. Multiple connected sources (Red Hat CVE entry, CNVD/CVE listings, CVE records, and WP vulnerability databases) corroborate that the vulnerability is a CSRF issue in the...

CVE-2017-18547

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms...

Intranet_Penetration_Tips

It is an offensive tool for network penetration. The repository contains some internal penetration tips compiled in early 2018, but has since been updated slowly. The author has made the repository public in hopes of collaborating with others to update and maintain it...

CVE-2017-18547: Cross-Site Request Forgery (CSRF)

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms...

PT-2019-8481

Name of the Vulnerable Software and Affected Versions nelio-ab-testing plugin versions prior to 4.6.4 Description The issue concerns a CSRF problem in experiment forms. Recommendations For versions prior to 4.6.4, update to version 4.6.4 or later to resolve the issue...

Microsoft Font Subsetting - DLL Heap Corruption in ReadTableIntoStructure

Microsoft Font Subsetting - DLL Heap Corruption in ReadTableIntoStructure -----===== Background =====----- The Microsoft Font Subsetting DLL fontsub.dll is a default Windows helper library for subsetting TTF fonts; i.e. converting fonts to their more compact versions based on the specific glyphs...