PHP 5.5.33 Invalid Memory Write

Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...

Snapchat: XSS found on Snapchat website

Hi Snapchat Team, I've found a reflected XSS vulnerability on this page: https://www.snapchat.com/add/snapchat Example: https://www.snapchat.com/add/%22%3E%3Ch1%3EXSS%3C%2Fh1%3E Note: you should visit the page with a mobile user-agent since the server displays different information based on the...

Microsoft's Artificial Intelligence Tay Became a 'Racist Nazi' in less than 24 Hours

Tay, Microsoft’s new Artificial Intelligence AI chatbot on Twitter had to be pulled down a day after it launched, following incredibly racist comments and tweets praising Hitler and bashing feminists. Microsoft had launched the Millennial-inspired artificial intelligence chatbot on Wednesday,...

CoolPlayer (Standalone) build 2.19 - '.m3u' Stack Overflow

Exploit for windows platform in category local exploits Exploit Title: CoolPlayer Standalone build 2.19 - .m3u Stack Overflow Date: 22-03-2016 Software Link: https://sourceforge.net/projects/coolplayer/files/Coolplayer/219/CoolPlayer219Bin.zip Exploit Author: Charley Celice stmerry Contact:...

Faraday 1.0.17 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday introduces a new concept - IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit. The first of many releases in 2016, Faraday v.1.0.17 Community, Pro &...

X (Formerly Twitter): Sub-Domain Takeover

Hey ! Your subdomain web.mopub.com is pointing to DYN but you have not claimed it on DYN end. So what happens here is actually that, since web.mopub.com is pointing to DYN, DYNis actually checking if there's a host with that name. Which in this case was not true. So I was able to claim the domain...

JSN PowerAdmin 2.3.0 Code Exection / CSRF / XSS

--------------------------------------------------------- RatioSec Research Security Advisory RS-2016-001 --------------------------------------------------------- JSN PowerAdmin Joomla! Extension Remote Command Execution Via CSRF and XSS vulnerabilities...

Network Scanner 4.0.0.0 SEH Crash Proof Of Concept

-- coding: utf-8 -- Exploit Title: Network Scanner Version 4.0.0.0 SEH Crash POC POC Dork: N/A Date: 2016-02-15 Author: INSECT.B Twitter : @INSECT.B Facebook : https://www.facebook.com/B.INSECT00 Blog : http://binsect00.tistory.com Vendor Homepage: http://www.mitec.cz/ Software Link:...

Investors Application - Client Side Cross Site Vulnerability

Document Title: =============== Investors Application - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1540 Facebook Security ID: 246414938 Release Date: ============= 2016-02-12 Vulnerability Laboratory ID VL-ID:...

MyScript Memo v3.0 iOS - (Mail) Persistent Vulnerability

Document Title: =============== MyScript Memo v3.0 iOS - Mail Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1706 Release Date: ============= 2016-02-10 Vulnerability Laboratory ID VL-ID: ==================================== 170...

X (Formerly Twitter): CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)

Hi, 1 Go to twitterflightschool.com and start intercepting every request . 2 No csrf tokens are present in the requests 3 Even in account settings there are no csrf tokens Attacker could post on twitter timeline of user https://twitterflightschool.com/module/twitter-for-executives/chapter/final T...

Zomato: Twitter Disconnect CSRF

Hi Using this CSRF vulnerability one could disconnect Twitter account from their profiles. Vulnerable request GET /php/disconnecttwitterprofile.php HTTP/1.1 Host: www.zomato.com Connection: keep-alive Accept: text/html, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 Windows NT...

Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion

Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion Title: Ramui web hosting directory script 4.0 Remote File Include Vulnerability Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com Download: http://ramui.com/directory-script/download-v4.html Proof-of-Concept:...

Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion

Exploit for php platform in category web applications Title: Ramui web hosting directory script 4.0 Remote File Include Vulnerability Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com Download: http://ramui.com/directory-script/download-v4.html Proof-of-Concept:...

On the Linux Zero Day, Twitter Users Looking for Answers, and Bot Fraud

Mike Mimoso and Chris Brook discuss the week in news, including the Linux zero day–how it was patched in Android, Twitter users sent nation state messages that are still looking for answers, and bot fraud. Download: ThreatpostNewsWrapJanuary222016.mp3 Music by Chris Gonsalves...

Twitter State-Sponsored Attack Notification

Twitter’s decision to notify users when their accounts are targeted in state-sponsored attacks earned its share of praise. But Twitter’s silence in terms of specifics about the attacks—whether by choice or gagged by a National Security Letter—has foisted some anxiety upon those who were notified....

Shopify: Twitter Disconnect CSRF

Hello, Using this CSRF vulnerability one could disconnect twitter account from their profiles. Vulnerable request GET /auth/twitter/disconnect HTTP/1.1 Host: twitter-commerce.shopifyapps.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:43.0 Gecko/20100101 Firefox/43.0 Accept:...

Fortinet(FortiGate)suspected the presence of the SSH Backdoor influence 4. 0 to 5.0.7 version-bug warning-the black bar safety net

Overview 1 On 1 2 May, twitter user@esizkur published information that the Fortigate exist ssh back door, the impact of the version from 4. 0 to 5. 0. 7, and in the link given in the attached full attack using the code. According to the disclosure of information display, the attacker can use this...

X (Formerly Twitter): Insufficient OAuth callback validation which leads to Periscope account takeover

Hi, I would like to report an issue in the Periscope Twitter application which allows attacker to circumvent the callback locking to takeover victim's Periscope account which is connected to a Twitter account. Detail In the mobile Periscope app, the consumerkey and consumersecret for Twitter...

Happy 13th Birthday TaoSecurity Blog

Today, 8 January 2016, is the 13th birthday of TaoSecurity Blog! This is also my 3,000th blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. Kevin Mandia was my boss. Today I am starting my third year as Chief Security Strategist at...