WordPress White-Label Framework 2.0.6 - XSS Vulnerability

安装好whitelable主题之后漏洞文件位置是: /whitelable-framework/inc/snippets/form-sharebymailiframe.php Line 48 50: $recipient = $POST'recipemail'; if stripos$recipient, ',' $recipient = substr$recipient, 0, stripos$recipient, ','; 可以看到这里POST方式接收到的recipemail只是去掉了逗号之后的内容然后就直接存入变量$recipient Line 86: Your Message h...

WordPress White Label Framework theme 2.0.6 - XSS

White Label Framework theme is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress Theme White-Label Framework 2.0.6 - Cross-Site Scripting

WordPress Theme White-Label Framework 2.0.6 - Cross-Site Scripting Exploit Title: Wordpress White-Label Framework XSS Google Dork: inurl:/wp-content/themes/whitelabel-framework/inc/form-sharebymailiframe.php Date: 7 September 2015 Exploit Author: Outlasted Software Link: wordpress.com /...

WordPress Theme White-Label Framework 2.0.6 - Cross-Site Scripting

Exploit Title: Wordpress White-Label Framework XSS Google Dork: inurl:/wp-content/themes/whitelabel-framework/inc/form-sharebymailiframe.php Date: 7 September 2015 Exploit Author: Outlasted Software Link: wordpress.com / http://whitelabelframework.com/ Version: 2.0.6 Greetz to: TeaMp0isoN...

The use of Paypal vulnerabilities hackers to steal all your property in the Intangible-vulnerability warning-the black bar safety net

! The Egyptian security researcher Ebrahim Hegazy in Paypal on the website find a key storage-typeXSSvulnerability that may allow an attacker to steal your login credentials, or even in plaintext format to steal user credit card information! About Paypal Paypal, the continent known as PayPal, are...

Noriben - Your Personal, Portable Malware Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

White House Support for CISA Worries Privacy Advocates

While Congress is enjoying its annual summer recess, privacy advocates are worried that the White House’s recent endorsement of the controversial CISA bill–which has been criticized by DHS officials, among others–will push the information-sharing bill over the goal line. The Cybersecurity...

CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Flex BlazeDS 4.7.0 Description: When receiving XML encoded AMF messages containing DTD entities, the default XML parser configurations...

MainWP <= 2.0.22 - Unspecified

Email sent from vendor to users: "Today we released updates to both the MainWP Dashboard 2.0.23 and MainWP Child 2.0.23 that contain additional security hardening for a possible issue found by Francois Harvey and reported through out White Hat Reward Program. We encourage everyone to update both...

Government Asks for Security Community's Help on Technical Issues

LAS VEGAS–Washington is looking for a few good hackers. Politicians and policymakers in the United States generally are not thought of as being the most technically savvy lot. It’s a reputation that’s well-earned in some cases, with some politicians boasting about their inability to use email and...

Symantec Endpoint Protection Multiple Vulnerabilities

Exploit for multiple platform in category remote exploits Code White found several vulnerabilities in Symantec Endpoint Protection SEP, affecting versions 12.1 prior to 12.1 RU6 MP1. SEP Manager SEPM: CVE-2015-1486: Authentication Bypass CVE-2015-1487: Arbitrary File Write CVE-2015-1488: Arbitrar...

White House Says No Thanks to Snowden Pardon Petition

It’s been more than two years since Edward Snowden became a name as familiar to the millions of people who have no idea what the NSA actually does it is to the power players in Washington. In that time support for Snowden has waxed and waned, but the position of the White House on Snowden’s actio...

White hat hackers: part of the banks risk enterprise network platform to determine the memory vulnerability-vulnerability warning-the black bar safety net

The insurance company through the website and other online sales channels to sell insurance really“insurance”? Recently, a large listed life insurance companies were again exposed a“provincial system loopholes, leaks millions of customer information.” In fact, the securities daily on zqrbbaoxian...

Cyber UL Could Become Reality Under Leadership of Hacker Mudge

UPDATE–One of the longstanding problems in security–and the software industry in general–is the lack of any universally acknowledged authority on quality and reliability. But the industry moved one step closer to making such a clearinghouse a reality this week when Peiter Zatko, a longtime...

Mac OSX Safari 8.0.5 UXSS vulnerability technical analysis-vulnerability warning-the black bar safety net

Vulnerability description: The vulnerability affects version 6. 2. 6,7. 1. 6,8. 0. 61before the Apple Safari browser, the attacker can be through carefully constructed URLs to bypass the same origin policy any read the file. Vulnerability description: In the Safari browser, similar...

Hotels.com Phishing Scam Duping Travelers

An undisclosed number of travelers who use Hotels.com may have been victims of a phishing scheme. The company said some customers were recently tricked into disclosing their names, phone numbers, email addresses and travel bookings. An individual was reportedly able to convince customers that the...

White Way Systems SQL Injection

========================================================= + Title :- White Way Systems CMS - SQL Injection Vulnerability + Date :- 19 - June - 2015 + Vendor Homepage: :- http://whitewaysystems.co.za/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :-...

Federal Agencies to Move to HTTPS-Only Connections

Following the lead of many major Web services, the White House on Monday announced that it would move all of the federal government’s public sites and services to HTTPS-only. Tony Scott, the federal CIO, has issued a memorandum to all federal agencies and departments instructing them to move all ...

WordPress White Label CMS Plugin <= 1.5.2 - Stored Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Ed Felten Joins White house as Deputy CTO

Ed Felten, a professor at Princeton University and a well-respected voice on security and privacy issues, is joining the White House as the deputy CTO. In his new role, Felten will be working under Megan Smith, the CTO of the United States and a former Google vice president. Felten has been at...