Grafana -- Teams API IDOR

Grafana Labs reports: On Jan. 18, an external security researcher, Kürşad ALSAN from NSPECT.IO @nspectio on Twitter, contacted Grafana to disclose an IDOR Insecure Direct Object Reference vulnerability on Grafana Teams APIs. This vulnerability only impacts the following API endpoints:...

autonomous.ai Cross Site Scripting vulnerability OBB-2331845

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| autonomous.ai ---|--- Open Bug Bounty...

blog.commerceiq.ai Cross Site Scripting vulnerability OBB-2331810

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for CVE-2021-41349

Microsoft Exchange Exploit CVE-2021-41349 Exploiting: CVE-2021...

Jerusalem Post and Maariv hacked on Gen. Soleimani’s death anniversary

By Waqas On the morning of Monday 3rd, Jan 2022, hackers managed to deface the official website of Jerusalem Post and compromise Maariv's Twitter account. This is a post from HackRead.com Read the original post: Jerusalem Post and Maariv hacked on Gen. Soleimanis death anniversary...

X (Formerly Twitter): Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo.

An improper sanitization of the edit list feature at Twitter allowed an attacker to delete any Twitter user's list cover photo. By manipulating the media ID in the request, the attacker could delete the victim's cover photo, violating access controls...

JFrog: Impersonation attack via Broken link in "blog-author" page

A social media platform link of "Twitter" on https://jfrog.com/blog-author/john-peterson/ was broken and could've allowed a user to impersonate a reseller and attack / scam your customers. This happened because the account of twitter either deleted or changed their username. I thought I'd report ...

Indian PM Modi’s Twitter Account HACKED for Bitcoin scam

By Deeba Ahmed This was the second time that a Twitter account linked to PM Modi got compromised for a Bitcoin-related scam. This is a post from HackRead.com Read the original post: Indian PM Modis Twitter Account HACKED for Bitcoin scam...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j log4shell CVE-2021-44228 Public IoCs list Public IoCs...

X (Formerly Twitter): Link-shortener bypass (regression on fix for #1032610)

Report 1032610, entitled Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links was closed as Resolved about six months ago. However, a regression on the fix for the vulnerability in question seems to have occurred, and the bug is reproducible with the...

radiozet.pl Cross Site Scripting vulnerability OBB-2294844

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ThinkUp path traversal vulnerability

ThinkUp is a free, installable web application from ThinkUp USA, Inc. Used to gain insight into activity on social networks such as Twitter, Facebook and Instagram, ThinkUp has a security vulnerability that stems from the fact that ThinkUp 2.0-beta is affected by a path manipulation vulnerability...

Exploit for Path Traversal in Grafana

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All cre...

ThinkUp 路径遍历漏洞

ThinkUp is a free, installable web application from ThinkUp USA, Inc. Used to gain insight into activity on social networks such as Twitter, Facebook and Instagram, ThinkUp has a security vulnerability that stems from the fact that ThinkUp 2.0-beta is affected by a path manipulation vulnerability...

kupujemprodajem.com Cross Site Scripting vulnerability OBB-2290415

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| kupujemprodajem.com ---|--- Open Bug...

Twitter Bans Users From Posting 'Private Media' Without a Person's Consent

Twitter on Tuesday announced an expansion to its private information policy to include private media, effectively prohibiting the sharing of photos and videos without express permission from the individuals depicted in them with an aim to curb doxxing and harassment. "Beginning today, we will not...

procenter.ruready.nd.gov Cross Site Scripting vulnerability OBB-2288218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Code Security Advent Calendar 2021

We are happy to announce our sixth consecutive Code Security Advent Calendar! Born at RIPS in 2016, each calendar comprises 24 little code puzzles containing hidden security vulnerabilities that wait to be spotted. This is our way to share good vibes with the community while learning and having f...

All Vulnerabilities for cach.dhet.gov.za Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| cach.dhet.gov.za ---|--- Open Bug Bount...

Redherd Framework -A Collaborative And Serverless Framework For Orchestrating A Geographically Distributed Group Of Assets

RedHerd is a collaborative and serverless framework for orchestrating a geographically distributed group of assets capable of conducting simulating complex offensive cyberspace operations. --- Getting Started Take a look at the RedHerd documentation for instructions on how to getting started with...