Circa due settimane fa, a Padova, si è tenuto l’evento Italian Hacker Camp 2018, un vero e proprio campeggio per appassionati del mondo dell’informatica (ma non solo). L’evento si è svolto dal 2 al 5 agosto e offriva alle persone, come si può intuire dal nome, la possibilità di fermarsi lì con la propria tenda e … Continue reading Italian Hacker Camp 2018
SUMMARY In Simplenote 1.1.3 – Desktop app there is a stored XSS vulnerability that can be used to execute arbitrary code. If there is malicious code in the note and the user tries to print it (for example to save it as a PDF), the malicious code runs. #358049 – RCE via Print function [Simplenote 1.1.3 – Desktop … Continue reading From XSS to RCE in Simplenote 1.1.3
Qualche giorno fa il giornalista de Il Post Emanuele Menietti ha tweetato questo: ci sarà pur un modo per filtrare tutti quelli con la bandierina dell'italia nel nome del profilo e con foto che non troveresti manco sulle credenze nei tinelli a predappio. — emanuele menietti (@emenietti) July 7, 2018 Mi sono quindi domandato se … Continue reading Quali utenti usano 🇮🇹 nel nickname di Twitter?
A few days ago some researchers discovered an HTML Injection vulnerability in Signal Desktop and they wrote a public disclosure. The Signal team quickly released an update on May 11th, the problem was in the file /js/views/message_view.js. Reading the changes to message_view.js, it seemed that the Signal team had only fixed the “problem of the URL“. So, maybe, … Continue reading HTML Injection in Signal Desktop 1.10.1
INFO Product: GD bbPress Attachments Version: 2.5 Active installations: 10,000+ Product page: https://it.wordpress.org/plugins/gd-bbpress-attachments/ DESCRIPTION An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary javascript code via filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $error[‘file’] in /code/attachments/front.php (line 349) is not … Continue reading GD bbPress Attachments 2.5 – Authenticated stored XSS
