Why Bugfix Postmortems Are Good For Web3
https://medium.com/immunefi/why-bugfix-postmortems-are-good-for-web3-a400f350adb0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This past year has been eventful for anyone building on the Web3 stack — over the course of the year, DeFi has grown from a nascent…Continue reading on Immunefi » (https://medium.com/immunefi/why-bugfix-postmortems-are-good-for-web3-a400f350adb0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Check If You Have to Worry About the Latest HTTP Protocol Stack Flaw

In this Tech Tip, SANS Institute’s Johannes Ullrich suggests using PowerShell to identify Windows systems affected by the newly disclosed vulnerability in http.sys.

Dark Reading: Attacks/Breaches
Microsoft RDP Bug Enables Data Theft, Smart-Card Hijacking

The vulnerability was patched this week in Microsoft's set of security updates for January 2022.

Dark Reading: Attacks/Breaches
Redefining the CISO-CIO Relationship

While these roles have different needs, drivers, and objectives, they should complement each other rather than compete with one another.

Why Bugfix Postmortems Are Good For Web3

This past year has been eventful for anyone building on the Web3 stack — over the course of the year, DeFi has grown from a nascent…Continue reading on Immunefi »
Read more...

XSS Filter Evasion + IDOR
https://jmrcsnchz.medium.com/xss-filter-evasion-idor-3d4624758ff0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi there. I’m JM Sanchez, a student, and a bug bounty hunter. After months of duplicate reports, I finally found a valid high severity bug.Continue reading on Medium » (https://jmrcsnchz.medium.com/xss-filter-evasion-idor-3d4624758ff0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Revealed: Emerging Ransomware Group, Leaked AWS Accounts, & Secret Log4j Discussions

https://external-preview.redd.it/Z9aR552obG7bWmg2TCNx1ZuqPFC_paULdhiqsXm0TrY.jpg?width=640&crop=smart&auto=webp&s=0be877ac24a2f9c9d698913d6c780a91dbb8db0e submitted by /u/rangeva
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

XSS Filter Evasion + IDOR

Hi there. I’m JM Sanchez, a student, and a bug bounty hunter. After months of duplicate reports, I finally found a valid high severity bug.Continue reading on Medium »
Read more...

Exploit Collector
DMCA.com Improper Access Control / Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
DMCA.com suffers from improper access control, persistent cross site scripting, and improper input validation vulnerabilities.

MD5 | de3eab0ce1d4e59fca59fb8cb0848dc7

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SonicWall SMA 100 Series Authenticated Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Diagnostic Lab Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Online Diagnostic Lab Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 35588b27be6d86e8b5952153487f66da

Download
#Exploit Title: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)
#Date: 11/01/2022
#Exploit Author: Himash
#Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/odlms.zip
#Version: 1.0
#Tested on: Kali Linux

Online Diagnostic Lab Management System 1.0 is vulnerable to stored cross-site-scripting.
Stored cross-site scripting (persistent XSS) arises when an application receives its data from
an untrusted source and includes that data within its responses in an unsafe way.

#Steps to Reproduce

1. Login to the admin account with username 'admin' and password 'admin123'

2. Navigate to the 'User List' option

3. Create new user by adding following payload in
First Name and Last Name fields.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hospitals Patient Records Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Hospitals Patient Records Management System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

MD5 | b843c5dce45d39b6dcbcd8448e2e1ba7

Download
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A Stored XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=doctors
2- Add a Doctor, paste the payload in specialization
3- Alert will pop whenever the page is accessed.
----
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_list
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.
----

# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_types
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video