Critical RCE Flaw Reported in MyBB Forum Software—Patch Your Sites
A pair of critical vulnerabilities in a popular bulletin board software called MyBB could have been chained together to achieve remote code execution (RCE) without the need for prior access to a privileged account.
The flaws, which were discovered by independent security researchers Simon Scannell and Carl Smith, were reported to the MyBB Team on February 22, following which it released an update (version 1.8.26) on March 10 addressing the issues.
CVE-2021-27889 - persistent XSS vulnerability enabling any unprivileged forum user to embed stored XSS payloads into threads, posts, and even private messages.
CVE-2021-27890 - SQL injection in a forum's theme manager that could result in an authenticated RCE.
CVE-2021-27946 - Improper validation of the number of votes in thread poll options, leading to SQL injection
CVE-2021-27947 - Improper sanitization of certain forum data, causing SQL injection when used in subsequent queries
CVE-2021-27948 - Additional User Groups ID numbers can be saved without proper validation in the Admin Control Panel, resulting in SQL injection, and
CVE-2021-27949 - A reflected XSS vulnerability in custom Moderator Tools, when user input attached to CSRF token-protected POST requests is not properly sanitized
https://thehackernews.com/2021/03/critical-rce-flaw-reported-in-mybb.html
@Phantasm_Lab
A pair of critical vulnerabilities in a popular bulletin board software called MyBB could have been chained together to achieve remote code execution (RCE) without the need for prior access to a privileged account.
The flaws, which were discovered by independent security researchers Simon Scannell and Carl Smith, were reported to the MyBB Team on February 22, following which it released an update (version 1.8.26) on March 10 addressing the issues.
CVE-2021-27889 - persistent XSS vulnerability enabling any unprivileged forum user to embed stored XSS payloads into threads, posts, and even private messages.
CVE-2021-27890 - SQL injection in a forum's theme manager that could result in an authenticated RCE.
CVE-2021-27946 - Improper validation of the number of votes in thread poll options, leading to SQL injection
CVE-2021-27947 - Improper sanitization of certain forum data, causing SQL injection when used in subsequent queries
CVE-2021-27948 - Additional User Groups ID numbers can be saved without proper validation in the Admin Control Panel, resulting in SQL injection, and
CVE-2021-27949 - A reflected XSS vulnerability in custom Moderator Tools, when user input attached to CSRF token-protected POST requests is not properly sanitized
https://thehackernews.com/2021/03/critical-rce-flaw-reported-in-mybb.html
@Phantasm_Lab
Forwarded from @Phantasm_Lab
Criminals on CCTV: Scammers caught red-handed!
https://www.linkedin.com/posts/jason-murrell-melbourne_cyberaware-scammers-cybersecurity-ugcPost-6640735602474090496-zlNr
@Phantasm_Lab
Way too many people fall victim to scams around the world every day. Many are run from criminal call centres abroad, where teams of fraudsters operate around the clock.One man in the UK, who goes by the name "Jim Browning", decided to do something about it. He hacked into a call centre in India from where scammers target their victims.Jim gained access to the recorded scam phone calls as well as CCTV footage exposing the scammers at work.What Jim did was illegal - but he says he wants to stop the fraudsters, and he passed his footage on to BBC Panorama.https://www.linkedin.com/posts/jason-murrell-melbourne_cyberaware-scammers-cybersecurity-ugcPost-6640735602474090496-zlNr
@Phantasm_Lab
Linkedin
Jason Murrell on LinkedIn: #cyberaware #scammers #cybersecurity #computersandtheinternet | 1,016 comments
Criminals on CCTV: Scammers caught red-handed!
Way too many people fall victim to scams around the world every day. Many are run from criminal call centres… | 1,016 comments on LinkedIn
Way too many people fall victim to scams around the world every day. Many are run from criminal call centres… | 1,016 comments on LinkedIn
Forwarded from Desktop Themes Channel via @like
Forwarded from Desktop Themes Channel
Fuschian Egg.tdesktop-theme
25.9 KB
Forwarded from Desktop Themes Channel via @like
Forwarded from Desktop Themes Channel
Universe.tdesktop-theme
2.3 MB
Forwarded from @Phantasm_Lab
The Hacker Wars takes you to the front lines of the high-stakes battle over the fate of the Internet, freedom and privacy.
🕴🏼 @Phantasm_Lab
🕴🏼 @Phantasm_Lab
Forwarded from @Phantasm_Lab
The Hacker Wars leva você até a linha de frente da batalha de alto risco sobre o destino da Internet, liberdade e privacidade.
🕴🏼 @Phantasm_Lab
🕴🏼 @Phantasm_Lab
Forwarded from @Phantasm_Lab
THE HACKER WARS - Legendado.tar.gz
774.5 MB
Security Talks
A place to agroup and organize lectures from security conferences around the world
https://news.1rj.ru/str/SecTalks
A place to agroup and organize lectures from security conferences around the world
https://news.1rj.ru/str/SecTalks
How i got easy $$$ for SQL Injection Bug
https://rafipiun.medium.com/how-i-got-easy-for-sql-injection-bug-7ff622236e4c
https://rafipiun.medium.com/how-i-got-easy-for-sql-injection-bug-7ff622236e4c
Medium
How i got easy $$$ for SQL Injection Bug
S
Bypassing Web Application Firewall Part 1
https://medium.com/@iratoon/bypassing-web-application-firewall-part-1-3cfd7a1b1159
Bypassing Web Application Firewall Part 2
https://medium.com/@iratoon/bypassing-web-application-firewall-part-2-269470e0c40b
Bypassing Web Application Firewall Part 3
https://medium.com/@iratoon/bypassing-web-application-firewall-part-3-521fd66a6422
Bypassing Web Application Firewall Part 4
https://medium.com/@iratoon/bypassing-web-application-firewall-part-4-862e9929e350
https://medium.com/@iratoon/bypassing-web-application-firewall-part-1-3cfd7a1b1159
Bypassing Web Application Firewall Part 2
https://medium.com/@iratoon/bypassing-web-application-firewall-part-2-269470e0c40b
Bypassing Web Application Firewall Part 3
https://medium.com/@iratoon/bypassing-web-application-firewall-part-3-521fd66a6422
Bypassing Web Application Firewall Part 4
https://medium.com/@iratoon/bypassing-web-application-firewall-part-4-862e9929e350
Medium
Bypassing Web Application Firewall Part — 1
As many of you may know, a Web Application Firewall is a firewall that sits in front of our web applications, and filters, analyzes and…
Forwarded from The Channel has been removed (Zero Day Windows)
⚡⚡ Ccobalt Strike 4.3 [bug fix] + Toolkits 2021⚡⚡
SHA256 hash of cobaltstrike.jar:
📩 DM If you are interested to Cobalt Strike 4.3 @anoneghost
🎥 Watch Video Demo :
https://vimeo.com/526671360
SHA256 hash of cobaltstrike.jar:
c3c243e6218f7fbaaefb916943f500722644ec396cf91f31a30c777c2d559465 Cobalt Strike 4.3 Licensed📩 DM If you are interested to Cobalt Strike 4.3 @anoneghost
🎥 Watch Video Demo :
https://vimeo.com/526671360
Vimeo
Cobalt Strike 4.3 + Toolkits 2021 | 0Day Priv8 Tools
For More Detail : https://t.me
Most Popular Burp Extensions Explained: Request Smuggler, Logger++ and others
https://www.youtube.com/watch?v=BZTvfqn2NMQ
https://www.youtube.com/watch?v=BZTvfqn2NMQ
YouTube
Most Popular Burp Extensions Explained: Request Smuggler, Logger++ and others #burpsuite #hacking
In this video, I will explain the 3 or 4 most popular BurpSuite extensions.
- Download your FREE Web hacking LAB: https://thehackerish.com/owasp-top-10-lab-vm-free
- Read more on the blog: https://thehackerish.com
- Support this work: https://thehackerish.com/how…
- Download your FREE Web hacking LAB: https://thehackerish.com/owasp-top-10-lab-vm-free
- Read more on the blog: https://thehackerish.com
- Support this work: https://thehackerish.com/how…
Ferramentas para Hardware Hacking - 1º Ethical Hacking Summit - #01 - Julio Della Flora
https://www.youtube.com/watch?v=cHy0vUC2wzg
https://www.youtube.com/watch?v=cHy0vUC2wzg
YouTube
Ferramentas para Hardware Hacking - 1º Ethical Hacking Summit - #01 - Julio Della Flora
#uniciv #ethical #hacking
☑️Receba o Certificado Digital do evento:
https://materiais.estudeti.com.br/hacker-summit-01-uniciv
☑️ Desconto em certificações de Ethical Hacking: http://bit.ly/EXIN_UNICIV
☑️ Curso de Hardware Hacking, IoT Pentest e Red Team…
☑️Receba o Certificado Digital do evento:
https://materiais.estudeti.com.br/hacker-summit-01-uniciv
☑️ Desconto em certificações de Ethical Hacking: http://bit.ly/EXIN_UNICIV
☑️ Curso de Hardware Hacking, IoT Pentest e Red Team…
GraphQL abuse: Bypass account level permissions through parameter smuggling
https://labs.detectify.com/2018/03/14/graphql-abuse/
https://labs.detectify.com/2018/03/14/graphql-abuse/
Labs Detectify
GraphQL abuse: Bypass account level permissions through parameter smuggling - Labs Detectify
Jon Bottarini writes about the interesting bugs he discovered when he took a closer look at Facebook’s popular GraphQL.
Ataques contra servidores Microsoft Exchange crescem 1028% em uma semana
Depois do descobrimento de quatro vulnerabilidades de dia zero no Microsoft Exchange, no começo deste mês, o número de tentativas de ataques às empresas clientes da ferramenta aumentou 1028%, indo de 700 na primeira semana, para 7.200 na segunda semana de março, informa a equipe de pesquisa da Check Point, fornecedora israelense de segurança da informação.
https://thehack.com.br/ataques-contra-servidores-microsoft-exchange-crescem-1028-em-uma-semana/
Depois do descobrimento de quatro vulnerabilidades de dia zero no Microsoft Exchange, no começo deste mês, o número de tentativas de ataques às empresas clientes da ferramenta aumentou 1028%, indo de 700 na primeira semana, para 7.200 na segunda semana de março, informa a equipe de pesquisa da Check Point, fornecedora israelense de segurança da informação.
https://thehack.com.br/ataques-contra-servidores-microsoft-exchange-crescem-1028-em-uma-semana/
The Hack
Ataques contra servidores Microsoft Exchange crescem 1028% em uma semana
Atualização de correção deve ser feita manualmente. No Brasil, ameaça pode ser ainda mais séria, já que muitas empresas utilizam servidores internos desatualizados
$12,000 Grafana SSRF in Gitlab - Bug Bounty Reports Explained
https://www.youtube.com/watch?v=Uklsk1WZ2EU
https://www.youtube.com/watch?v=Uklsk1WZ2EU
YouTube
$12,000 Grafana SSRF in Gitlab - Bug Bounty Reports Explained
📧 Subscribe to BBRE Premium: https://bbre.dev/premium
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw
This video is about Grafana SSRF vulnerability that was reported to Gitlab bug bounty program on Hackerone.…
✉️ Sign up for the mailing list: https://bbre.dev/nl
📣 Follow me on Twitter: https://bbre.dev/tw
This video is about Grafana SSRF vulnerability that was reported to Gitlab bug bounty program on Hackerone.…
Forwarded from Android Security & Malware
WhatsApp scam messages - what happens when you click on them
https://youtu.be/Dc7Y1fiZGuA
https://youtu.be/Dc7Y1fiZGuA
YouTube
What happens when you click on that WhatsApp scam message | Huawei Mate 40 Pro giveaway | Amazon
Beware of recent WhatsApp scam message that instead of winning Huawei Mate 40 Pro 5G, might get user into troubles.
In the video I will show you:
1) What happens when you click on that link
2) I will go through whole scam and redirections process
3) How…
In the video I will show you:
1) What happens when you click on that link
2) I will go through whole scam and redirections process
3) How…
Forwarded from @Phantasm_Lab
#Documentario #CyberCrime #Hackerville
https://m.youtube.com/watch?v=mJ0bN6Nq0PE
🕴 @Phantasm_Lab
Assista o documentário sobre cibercrime que apresenta a cidade romena chamada “Hackerville” ou a “Cidade mais perigosa da Internet”. Hackers blackhat condenados, como Guccifer (nome real), falam sobre worms, vírus, engenharia social, roubo de identidade e até sobre invadir o e-mail de Hillary Clinton.https://m.youtube.com/watch?v=mJ0bN6Nq0PE
🕴 @Phantasm_Lab
YouTube
A Cidade Mais Perigosa da Internet
Em breve: http://mostdangeroustown.com
Assista o documentário sobre cibercrime que apresenta a cidade romena chamada “Hackerville” ou a “Cidade mais perigosa da Internet”. Hackers blackhat condenados, como Guccifer (nome real), falam sobre worms, vírus, engenharia…
Assista o documentário sobre cibercrime que apresenta a cidade romena chamada “Hackerville” ou a “Cidade mais perigosa da Internet”. Hackers blackhat condenados, como Guccifer (nome real), falam sobre worms, vírus, engenharia…