Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
GitLab patches critical remote code execution bug

GitLab patches critical remote code execution bugPost Views: 26 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 1 Minute GitLab has issued a security update to address a critical vulnerability that could lead to remote code execution (RCE).The vulnerability could allow an authenticated user to achieve remote code execution via the ‘Import from GitHub API’ endpoint, an advisory from GitLab reads.

Tracked as CVE-2022-2884, the security issue is present in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.3.4 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
It has since been patched, as GitLab urges all users to update to the latest version.

“These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version,” the blog post reads.

It was reported to GitLab by ‘yvvdwf’ through HackerOne’s bug bounty program.
See Also: So you want to be a hacker? Find Hidden Info using Google Dorking manually, and Automated using Pagodo
See Also: So you want to be a hacker? Recon Tool: Is it alive? https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Sponsor.png Other updatesIn addition to the critical security patches, version 15.3, released yesterday (August 22), also contains a number of usability and UI improvements as well as more complex password requirements for GitLab accounts.
See Also: So you want to be a hacker? Apple security updates fix 2 zero-days used to hack iPhones
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-3-300x150.png Over 80000 Hikvision vulnerable cameras exposed onlineAugust 23, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-7-300x150.png WordPress sites hacked with fake Cloudflare DDoS alerts pushing malwareAugust 22, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-4-1-300x150.png Apple security updates fix 2 zero-days used to hack iPhonesAugust 19, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-2-300x150.png Researchers found over 9,000 accessible VNC servers, without a passwordAugust 15, 2022
Reading Time: 5 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post GitLab patches critical remote code execution bug first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

GitLab patches critical remote code execution bug | Black Hat Ethical Hacking

GitLab has issued a security update to address a critical vulnerability that could lead to remote code execution (RCE).

6 viewsedited 08:45

Hacking Articles Tips Tricks Videos Tutorials

4 views09:23

Hacking Articles Tips Tricks Videos Tutorials

4 views09:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
🔥 RPCMon: A new tool based on Event Tracing for Windows to monitor RPC calls 🔥

https://external-preview.redd.it/9WQc92niZF8B8viv0IFPC9-tq0hbch4XW_pvoNIl05M.jpg?width=640&crop=smart&auto=webp&s=b8d4af0ce733a4f5798c4d20cad027afa968a92c submitted by /u/0x1337asd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

🔥 RPCMon: A new tool based on Event Tracing for Windows to monitor...

Posted in r/hacking by u/0x1337asd • 1 point and 0 comments

5 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
A Quick Guide to Bug Bounty Submissions

Hi, I just came across a post about someone that felt like they were unjustly not compensated for a bug submitted on a bug bounty program and I realized that a lot of people in the comments don't understand how vulnerabilities are classified and, therefore how much they are worth. So I decided to write this quick post to try to make it simple to everyone.

Disclaimer: not all bug bounty programs have the same rules, this is just a general guide about the most common ones.

First, every program has a scope. Both in terms of endpoints and in terms of types of vulnerabilities. If your bug affects a endpoint that is out of scope, you won't get paid.

Now, the most important part and the part that people seem to find trickier:

The severity of a bug is calculated using the CVSS score. This score is based on CIA, which stands for confidentiality, integrity and availability of data. That means that all of these are considered to have ZERO IMPACT:

* A bug that affects a company's reputation
* A bug that causes spam on the users
* A bug that causes a financial loss

Those vulnerabilities, while they could feel like they would make a good report, have no impact on data which is usually what determines if a bug is worth money or not.

So before you work for a long time on a bug and on a report, ask yourself these questions:

* does this bug affect a endpoint that is explicitly in scope ?
* is this bug part of a list of bugs that aren't accepted in this program ?
* can I see, change or delete some data that I shouldn't have the right to ?

If you answered no to one of these questions, your bug is probably not going to get paid.

As a last note, if you find a bug that, let's say, causes a financial loss on the company, I encourage you to disclose it. You are probably not entitled to a compensation but the company might still give you a bounty or something to thank you for your report, even if it does not qualify for a normal remuneration. They don't have to, but this is still fairly common.

Always remember that the people that review bug bounty submissions are usually also bug bounty hunters in their spare time.

submitted by /u/PetiteGousseDAil
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

A Quick Guide to Bug Bounty Submissions

Hi, I just came across a post about someone that felt like they were unjustly not compensated for a bug submitted on a bug bounty program and I...

7 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

🔥 RPCMon: A new tool based on Event Tracing for Windows to monitor...

Posted in r/hacking by u/0x1337asd • 1 point and 0 comments

6 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

6 views09:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Misconfigured Meta Pixel exposed healthcare data of 1.3M patients

https://external-preview.redd.it/I_8KKHz4K2uputwcXAEtTIbe5mu8EJItz5f53QUHl-M.jpg?width=320&crop=smart&auto=webp&s=9242016862ee05689264c32066370ee7bacb069c submitted by /u/DenofBlerds
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Misconfigured Meta Pixel exposed healthcare data of 1.3M patients

Posted in r/hacking by u/DenofBlerds • 1 point and 0 comments

5 viewsedited 09:23

Hacking Articles Tips Tricks Videos Tutorials

IDOR Pada NFT marketplace uniqart.io
https://aminudin.medium.com/idor-pada-nft-marketplace-uniqart-io-804676c1f6ab?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

IDOR Pada NFT marketplace uniqart.io

Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied…

5 viewsedited 09:29

Hacking Articles Tips Tricks Videos Tutorials

5 views09:29

Hacking Articles Tips Tricks Videos Tutorials

Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied…Continue reading on Medium » (https://aminudin.medium.com/idor-pada-nft-marketplace-uniqart-io-804676c1f6ab?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

IDOR Pada NFT marketplace uniqart.io

Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied…

5 viewsedited 09:29

Hacking Articles Tips Tricks Videos Tutorials

5 views10:28

About

Blog

Apps

Platform