updates.synergy-usa-llc.com XSS vulnerability

Vulnerable URL: http://updates.synergy-usa-llc.com/ShowRansomSum.asp?jsoncallback=prompt/OPENBUGBOUNTY/...

Analyzing the Malware Analysts – Inside FireEye’s FLARE Team

At the Black Hat USA 2016 conference in Las Vegas last week, I was fortunate to sit down with Michael Sikorski, Director, FireEye Labs Advanced Reverse Engineering FLARE Team. During our conversation we discussed the origin of the FLARE team, what it takes to analyze malware, Michael’s book...

New HTTPS URL Leakage Attack Leaves PCs, Macs, Linux Systems Vulnerable

LAS VEGAS — Researchers have found flaws in the Web Proxy AutoDiscovery protocol tied to DHCP and DNS servers that allow hackers spy on HTTPS-protected URLs and launch a myriad of different malicious attacks against Linux, Windows or Mac computers. According to the security firm SafeBreach, this...

Resurrection of the Evil Miner

At FireEye Labs, we recently detected the resurgence of a coin mining campaign with a novel and unconventional infection vector in the form of an iFRAME inline frame – an HTML document embedded inside another HTML document on a web page that allows users to get content from another separate sourc...

brother-usa.com XSS vulnerability

Vulnerable URL: http://www.brother-usa.com/leavingoursite.aspx?goto=jaVasCript:"/-///'//// /oNcliCk=alert/OPENBUGBOUNTY/ //%0D%0A%0D%0A// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Yahoo Discloses Contents of Three National Security Letters

Yahoo today disclosed the contents of three National Security Letters it has received since 2013, the first time a company has made such a disclosure since the passage of the USA FREEDOM Act. Under the law, the FBI is now required to periodically review whether non-disclosure around National...

expo.usa.canon.com XSS vulnerability

Vulnerable URL: https://expo.usa.canon.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Yahoo Releases Second Wave Unsealed FISA Documents

Yahoo officially released part two of its once-secret government documents that were part of its 2007 court battle with the Foreign Intelligence Surveillance Court FISC that forced it to reveal sensitive customer data requested by the National Security Agency. This second wave of documents brings...

Exploiting XXE In File Upload Functionality

Just wanted to post some details from my BH USA 2015 briefing "Exploiting XXE In File Upload Functionality". The youtube video is up: I also gave an updated version of the presentation in November for the Blackhat Webcast Series. It included more file types; PDF, JPG, and GIF. The link is here:...

Exploiting XXE In File Upload Functionality

Just wanted to post some details from my BH USA 2015 briefing "Exploiting XXE In File Upload Functionality". The youtube video is up: I also gave an updated version of the presentation in November for the Blackhat Webcast Series. It included more file types; PDF, JPG, and GIF. The link is here:...

ROPInjector - Convert any Shellcode in ROP and patch it into a given Portable Executable (PE)

A tool written in C Win32 to convert any shellcode in ROP and patch it into a given portable executable PE. It supports only 32-bit target PEs and the x86 instruction set. Published in Blackhat USA 2015, "ROPInjector: Using Return Oriented Programming for Polymorphism and Antivirus Evasion" More...

Voyage: Usa Roads - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Voyage: Usa Roads published at the 'play' market has multiple vulnerabilities...

Gettysburg Cannon Battle USA - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Gettysburg Cannon Battle USA published at the 'play' market has multiple vulnerabilities...

Megabus USA - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Megabus USA published at the 'play' market has multiple vulnerabilities...

USA TODAY - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application USA TODAY published at the 'play' market has multiple vulnerabilities...

tamron-usa.com XSS vulnerability

Vulnerable URL: http://www.tamron-usa.com/dealers.php Details: Description| Value ---|--- Patched:| Yes, at 17.04.2017 Latest check for patch:| 17.04.2017 19:28 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 130200 Google Pagerank| 5 VIP website status:| No Che...

shelterboxusa.org XSS vulnerability

Vulnerable URL: http://www.shelterboxusa.org/trackbox.php?ClientName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:56 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

Today NSA has Stopped its Bulk Phone Surveillance Program

Rejoice! From this morning, you can call freely to anyone, talk anything without any fear of being spied by the United States National Security Agency NSA, as the agency is not allowed to collect bulk phone records. Until now we all are aware of the NSA's bulk phone surveillance program – thanks ...

usa.angloinfo.com XSS vulnerability

Vulnerable URL: http://usa.angloinfo.com/search/?q=%22--%3E+%3C%2Fscript%3E%3Csvg%2Fonload%3D%27%3Balert%28%2FXSSPOSED%2F%29%3B%27%3E=Search Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 09:28 GMT Vulnerability type:| XSS Vulnerability status...

taurususa.com XSS vulnerability

Vulnerable URL: http://www.taurususa.com/gun-search.cfm Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 80394 Google Pagerank| 6 VIP website status:| No Check taurususa.com SSL...