CVE-2017-16203

The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation...

DNA Testing Service MyHeritage Leaks User Data of 92 Million Customers

Account data tied to 92 million users of the genealogy and DNA testing service MyHeritage were found on a third-party “private” server in a breach that exposed usernames and passwords of customers. The breach is the largest since last year’s Equifax leak of 147.9 million pieces of private data...

Automattic: Improper markup sanitization.

Summary One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change. PoC Paste the following HTML into a Simplenote. I am using the Simplenote app...

Oracle Knowledge Management XXE Leading to a RCE

Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle’s InQuira knowledge management products offer simple and convenient ways for users to access knowledge tha...

Oracle Knowledge Management 12.1.1 < 12.2.5 - XML External Entity Leading To Remote Code Execution

SSD Advisory – Oracle Knowledge Management XXE Leading to a RCE Vulnerability Summary The following advisory describe Information Disclosure found in Oracle Knowledge Management version 8.5.1. By enabling searches across a wide variety of sources, Oracle's InQuira knowledge management products...

Code injection

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server. Mitigation...

Web Servers File Download Manipulation

An attacker can manipulate a web server to download and execute code stored on a third party server...

myPHPcalendar Multiple Scripts cal_dir Parameter Remote File Inclusion

The remote web server appears to be hosting myPHPCalender. The installed version contains a vulnerability that could allow an attacker to make the remote host include php files hosted on a third party server. An attacker may use this flaw to inject arbitrary code in the remote host and gain a she...