CVE-2018-14888

CVE-2018-14888 affects the Eldenroot Thank You/Like plugin for MyBB (versions before 3.1.0). The vulnerability is a cross-site scripting (XSS) flaw in inc/plugins/thankyoulike.php where the post or thread subject is not properly sanitized, allowing an attacker to inject malicious scripts that exe...

MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE:...

MyBB Thank You / Like 3.0.0 Cross Site Scripting

Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14888 1. Description: This plugin...

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu...

MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting

Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu 18.04 CVE: CVE-2018-14888 1. Description: This plugin...

Microsoft Windows Kernel 'Win32k.sys' Local Privilege Escalation Vulnerability(CVE-2018-8120)

作者：bigric3 作者博客： 5月15日ESET发文其在3月份捕获了一个 pdf远程代码执行（cve-2018-4990）+windows本地权限提升（cve-2018-8120）的样本。ESET发文后，我从vt上下载了这样一份样本（）。初步逆向，大致明确如外界所传，该漏洞处于开发测试阶段，不慎被上传到了公网样本检测的网上，由ESET捕获并提交微软和adobe修补。测试特征字符串如下 定位样本中关键的代码并调试分析...

Korea In The Crosshairs

This blog post is authored by Warren Mercer and Paul Rascagneres and with contributions from Jungsoo An. A one year review of campaigns performed by an actor with multiple campaigns mainly linked to South Korean targets. Executive Summary This article exposes the malicious activities of Group 123...

aandjmobility.com XSS vulnerability

Vulnerable URL: http://www.aandjmobility.com/thank-you.php Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6521848 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability...

Gratipay: Saying goodbye to HackerOne and Gratipay.

Thank you, HackerOne I would like to make this the final report to Gratipay and thank everyone that was involved in this amazing journey. Gratipay is shutting down at the end of the year https://gratipay.news/the-end-cbfba8f50981 and to finish on a happy note we closed all of our reports as...

grenoblewelcomesyou.com XSS vulnerability

Vulnerable URL: http://www.grenoblewelcomesyou.com/index.php?langue=fr%22%3E%3Csvg/onload=alertdocument.domain%3E=10=== Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:...

libgcrypt -- side-channel attack vulnerability

GnuPG reports: Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You"...

you-rope.net Open Redirect vulnerability

Vulnerable URL: http://www.you-rope.net/en/clickout?redirecturl=http%253A%252F%252Fopenbugbounty.org%252Fen%252Fprod%252Fssd-wrk-651%252F=293 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.11.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

FAQ: Citrix ADC on Microsoft Azure

Q: What is Citrix ADC, formerly Netscaler ADC, on Microsoft Azure? A: Citrix ACD on Microsoft Azure is a L4-L7 virtual networking appliance that ensures organizations have access to secure and optimized applications and assets deployed in the cloud. Citrix ADC on Azure provides a foundation for t...

What to Consider When Choosing a Security Vendor

Picking a security vendor for your managed service business should be about business model alignment, not product cost. If you’re a seasoned managed service provider MSP, you are already very familiar with the benefits of the pay-as-you-go business model. In fact, it’s most likely how you sell yo...

InsomniaX 2.1.8 Arbitrary Kernel Extension Loading Vulnerability

It was found that the loader application bundled with InsomniaX can be used to load arbitrary Kernel Extensions kext. The loader is normally used to load a kext file that is needed to disable the Lid Sleep. A flaw has been found in the loader that allows a local attacker to load or unload any...

Randstad Group Selects Trend Micro to Protect its Public Cloud Infrastructure

The Randstad Group is currently in the process of consolidating and centralizing its IT infrastructure across 30 IT departments, and will be providing service to more than 40 operating countries across four continents. To ensure the new infrastructure will have optimal security the company select...

you-nik.com XSS vulnerability

Vulnerable URL: http://www.you-nik.com/search.php?kwds=%3E%3Csvg/onload=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4844096 VIP website status:| No Check...

You can earn free. - Dangerous filesystem permissions, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application You can earn free. published at the 'play' market has multiple vulnerabilities...

You TV Player - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application You TV Player published at the 'play' market has multiple vulnerabilities...

WordPress Thank You Counter Button Plugin <= 1.8.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Vulnerable parameter is "paged". Solution Update plugin...