🐱‍💻 👍 Google Chrome - File System Access API - vulnerabilities reported by Maciej Pulikowski | Total Bug Bounty Reward: $5.000 | CVE-2021-21123 and 5 more... - Puliczek/CVE-2021-21123-PoC-Google-Ch...

MobileIron MDM exposes account enumeration and SFA to unauthenticated attacks. This analysis details how to mitigate this vulnerability.

0x00. TL;DRntopng 是一套开源的网络流量监控工具，提供基于 Web 界面的实时网络流量监控。支持跨平台，包括 Windows、Linux 以及 MacOS。ntopng 使用 C++ 语言开发，其绝大部分 Web 逻辑使用 lua 开发。 在针对 ntopng 的源码进行审计的过程中，笔者发现了 ntopng 存在多个漏洞，包括一个权限绕过漏洞、一个 SSRF 漏洞和多个其他安全问题，接着组合利用这些问题成功实现了部分版本的命令执行利用和管理员 Cookie 伪造。 比较有趣的是，利用的过程涉及到…

A fuzzing tool for email sender spoofing attack. 👻 - GitHub - mo-xiaoxi/ESpoofing: A fuzzing tool for email sender spoofing attack. 👻

作者：cheery@QAX-ATEAM && n0thing@QAX-ATEAM

CVE-2021-1732 is a 0-Day vulnerability exploited by the BITTER APT organization in one operation which was disclosed in February this year[1][2][3]. This vulnerability exploits a user mode callback opportunity in win32kfull module to break the normal execution…

师傅们，0day来啦~\x0a蓝凌OA EKP 后台SQL注入漏洞 CNVD-2021-01363

Intro The OAuth2 authorization protocol has been under fire for the past ten years. You've probably already heard about plenty of "return_uri" tricks, token leakages, CSRF-style attacks on clients, an

POC for CVE-2021-26871(Maybe). Contribute to robotMD5/CVE-2021-26871_POC development by creating an account on GitHub.

OSINT tool to get information from a Github and Gitlab profile and find user's email addresses leaked on commits. - GONZOsint/gitrecon

Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc - GitHub - xiaopan233/Mybb-XSS_SQL_RCE-POC: Mybb associate CVE-2021-27890 & CVE-2021-27889 to RCE poc

HackerOne report #962604 by muthu_prakash on 2020-08-19, assigned to @kaunghtet:

On December 22, 2020, our Threat Intelligence team responsibly disclosed a vulnerability in Facebook for WordPress, formerly known as Official Facebook Pixel, a WordPress plugin installed on over 500,000 sites. This flaw made it possible for unauthenticated…

近期，奇安信威胁情报中心在日常的样本运营中，捕获了多例实战攻防演习样本。样本主要以“薪酬调整”、“局处级干部进修”等话题为诱饵。部分样本仅有红雨滴高对抗沙箱能够触发完整的行为，甚至号称业界最强的anyrun沙箱也无能为力。

CVE-2021-3449 OpenSSL denial-of-service exploit 👨🏻‍💻 - riptl/cve-2021-3449

Collection of useful features in Burp Suite Application