Shadow Brokers Group Releases More Stolen NSA Hacking Tools & Exploits

Remember The Shadow Brokers? They are back. A hackers group that previously claimed to have stolen a bunch of hacking tools malware, zero-day exploits, and implants created by the NSA and gained popularity last year for leaking a portion of those tools is back. Today, The Shadow Brokers group...

X (Formerly Twitter): [██████████.gnip.com] .htpasswd disclosure

Greetings, There is a .htpasswd disclosure on your subdomain : - Go to : http://█████████.gnip.com/.htpasswd - previewgnip:██████ F173925 Fix : Protect the htpasswd file...

Twitter Cards Meta <= 2.4.5 - CSRF and XSS

The Twitter Cards Meta – Best Twitter Card Plugin for WordPress WordPress plugin was affected by a CSRF and XSS security vulnerability...

New RAT Targets Koreans And Is Skilled At Evading Detection

Researchers have identified a stealthy new remote access tool dubbed ROKRAT that leverages a bevy of anti-detection measures. The RAT targets the Korean language Microsoft Word alternative Hangul Word Processor HWP. ROKRAT was detected several weeks ago by Cisco Talos, who said the malware is par...

Follow Tool for Twitter - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Follow Tool for Twitter published at the 'play' market has multiple vulnerabilities...

The Struts S2-045 vulnerability heat analysis-vulnerability warning-the black bar safety net

Author: janesknow Chong Yu 404 laboratory Date: 2017-03-15 Background description Struts2 official to GMT 2017 3 December 6, 10pm published Struts2 there is a remote code execution vulnerability vulnerability number S2-045, CVE number: CVE-2017-5638, and rated as high-risk vulnerabilities. Becaus...

Microsoft Windows LoadUvsTable() Buffer Overflow

Date: 15-03-2017 Author: Hossein Lotfi https://twitter.com/hosselot CVE: CVE-2016-7274 1. Description An integer overflow error within the "LoadUvsTable" function of usp10.dll can be exploited to cause a heap-based buffer overflow. Full analysis is available at:...

Hundreds of High-Profile Twitter Accounts Hacked through 3rd-Party App

In a large-scale Twitter hack, thousands of Twitter accounts from media outlets to celebrities, including the European Parliament, Forbes, BlockChain, Amnesty International, UNICEF, Nike Spain and numerous other individuals and organizations, were compromised early Wednesday. The compromised...

PostMessage cross-domain vulnerability-vulnerability warning-the black bar safety net

Note: this article is“millet Security Center”original, reprint please contact the“millet Security Center” Background Value: $3000 Vulnerability cause: postMessage cross-domain vulnerabilities to cause, the use of the websocket receives a user authentication token Original address:...

[SECURITY] Fedora 25 Update: drupal7-metatag-1.21-1.fc25

The Metatag module allows you to automatically provide structured metadata, aka "meta tags", about your website. In the context of search engine optimization, when people refer to meta tags they are usually referring to the meta description tag and the meta keywords tag that may help improve the...

EPSON TMNet WebConfig 1.00 - Cross-Site Scripting

Exploit Title: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 Google Dork: intitle:"EPSON TMNet WebConfig Ver.1.00" Date: 3/3/2017 Exploit Author: Michael Benich Vendor Homepage: https://www.epson-biz.com/ Software Link: https://c4b.epson-biz.com/modules/community/index.php?contentid=50 Versio...

Wordpress Theagency Themes File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Themes Theagency File Upload Vulnerability Author : Berandal Google Dork: inurl:/wp-content/themes/theagency Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ Video Proof :...

X (Formerly Twitter): [URGENT] Opportunity to publish tweets on any twitters account

The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user. By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account. This...

[SECURITY] Fedora 24 Update: bitlbee-3.5.1-1.fc24

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

[SECURITY] Fedora 25 Update: bitlbee-3.5.1-1.fc25

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

X (Formerly Twitter): Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]

The reporter discovered a bug related to the Vine Archive which had the potential to expose the email address or phone number associated with a Vine account to a third party through the Vine API. The vulnerability was discovered by the reporter, triaged, and remediated within 24 hours of the...

Simple Twitter Metadata Scraper

Simple Twitter Metadata Scraper The goal of this simple python script is to analyze a Twitter profile through its tweets by detecting: Average tweet activity, by hour and by day of the week Timezone and language set for the Twitter interface Sources used mobile application, web browser, …...

President Trump's @POTUS Twitter Linked To A Private Gmail Account

It seems like the new American President's Twitter account could easily be hacked due to security blunders he made with the most powerful Twitter account in the world, experts warned. Days after we got to know that the newly inaugurated President Donald Trump was still using his old, insecure...

X (Formerly Twitter): Attacker can get vine repost user all informations even Ip address and location .

The researcher discovered that an endpoint used for providing information about Vine reposts was unintentionally disclosing the IP address the repost was made from. Upon receiving this report we immediately took steps to correct the issue and updated the misconfigured endpoint the same day the...

Massive Twitter Botnet Dormant Since 2013

A sizable and dormant Twitter botnet has been uncovered by two researchers from the University College London, who expressed concern about the possible risks should the botmaster decide to waken the accounts under his control. Research student Juan Echeverria Guzman and his supervisor and senior...