PT-2023-28780 · Moosocial · Moosocial

Name of the Vulnerable Software and Affected Versions: mooSocial version 3.1.8 Description: The issue concerns external service interaction on the post function. When executed, the server sends HTTP and DNS requests to an external server. The parameters affected are multiple, including messageTex...

n00b’s guide to DEF CON. Surviving the Matrix of the underground

Ah, DEF CON. The worlds largest hacker convention. A beacon for the diverse spectrum of cyber security enthusiasts. From code-cracking challenges to the infamous Wall of Sheep, the event is a hive of activities and opportunities. But before we dive into the world of hackerdom, lets get one thing...

WordPress YouTube Easy Embed (Wall/Rail) Plugin < 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Easy Embed Wall/Rail Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b0d95fa5dab1 Credits Rafie Muhammad...

Top Suspect in 2015 Ashley Madison Hack Committed Suicide in 2014

When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users, the companys then-CEO Noel Biderman was quick to point the finger at an unnamed former contractor. But as a new documentary series on Hulu reveals...

wall-paintings.be Cross Site Scripting vulnerability OBB-3312243

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

musikhaus-wall.de Cross Site Scripting vulnerability OBB-3265524

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Bypassing a Theft Threat Model

Thieves cut through the wall of a coffee shop to get to an Apple store, bypassing the alarms in the process. I wrote about this kind of thing in 2000, in Secrets and Lies page 318: My favorite example is a band of California art thieves that would break into peoples houses by cutting a hole in...

CVE-2023-25017

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

CVE-2023-25018

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

Authorization

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

RIFARTEK IOT Wall 跨站脚本漏洞

Rifartek IOT Wall is a security software from the Chinese company Rifartek. A cross-site scripting vulnerability exists in RIFARTEK IOT Wall v.22, which is caused by insufficient filtering of user input in the transport function. The vulnerability can be exploited to inject JavaScript to perform ...

CVE-2023-25018 Rifartek IOT Wall - Reflected XSS

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

CVE-2023-25017 Rifartek IOT Wall - Broken Access Control

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

CVE-2023-25017: Incorrect Authorization

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

CVE-2023-25017

CVE-2023-25017 affects RIFARTEK IOT Wall (reported variants reference v.22 in CNNVD). The vulnerability is described as incorrect authorization allowing an authenticated remote user with general privileges to perform specific privileged functions and access/modify all sensitive data. The connecte...

CVE-2023-25018

The CVE-2023-25018 issue affects the RIFARTEK IOT Wall transportation function, where insufficient input filtering enables a reflected XSS vulnerability. An authenticated remote attacker with general user privileges can inject JavaScript via manipulated input to cause a reflected XSS. The availab...

CVE-2023-25018 Rifartek IOT Wall - Reflected XSS

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

CVE-2023-25018: Improper Neutralization of Input During Web Page Generation

RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can inject JavaScript to perform reflected XSS Reflected Cross-site scripting attack...

CVE-2023-25017 Rifartek IOT Wall - Broken Access Control

RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to perform specific privileged function to access and modify all sensitive data...

KrebsOnSecurity in Upcoming Hulu Series on Ashley Madison Breach

KrebsOnSecurity will likely have a decent amount of screen time in an upcoming Hulu documentary series about the 2015 megabreach at marital infidelity site Ashley Madison. While I cant predict what the producers will do with the video interviews we shot, its fair to say the series will explore...