Explore >> Select a destination
|
You are here 
|
zhero-web-sec.github.io | ||
| | | | |
labanskoller.se
|
|
| | | | | During 2021 I had access to a facility equipped with an alarm system from Securitas Direct. I had access as a regular user to Securitas Direct's My Pages at mypages-pro.securitas-direct.com, which is used to administer some aspects of one's security alarm installation. That web application suffered a CWE-384 Session Fixation vulnerability which can be used by an attacker in a so-called Man-In-The-Middle (MiTM) position. Home page of Securitas Direct My Pages In summary, if an attacker is on the same netw... | |
| | | | |
positive.security
|
|
| | | | | Using a still unpatched vulnerability in the PHP library dompdf (used for rendering PDFs from HTML), we achieved RCE on a web server with merely a reflected XSS vulnerability as entry point. | |
| | | | |
blog.kotowicz.net
|
|
| | | | | A blog on security, malware, cryptography, pentesting, javascript, php and whatnots | |
| | | | |
hidde.blog
|
|
| | | Hidde's blog about web accessibility, standards, HTML, CSS, JavaScript and more. | ||
