PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EzAdsPro BlackBox Advisory

bishopfox.com | blog | #information-disclosure | #pii | #credentials | #security-advisory | #directory-listing | #ezadspro
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Advisory: the EzAdsPro 'BlackBox' platform left directory listings enabled across /feeds/, /sms/ and /blackbox/, exposing customer PII and hardcoded credentials; the vendor fixed it server-side.
Published
Collected

Related coverage

blog · labs.cognisys.group
Keys to the Kingdom Live Stripe Credentials Exposed via Unauthenticated OAuth Endpoint
There is a particular category of finding that stops you mid-test. Not because it is technically complex, but because of what you are looking at. A single unauthenticated GET request that returns live payment credentials for a platform processing real customer transactions is one such finding.
vulnerability · hackerone.com
How an Information Disclosure Vulnerability Led to Critical Data Exposure
Information disclosure makes up 10% of HackerOne findings. The article covers how exposed keys, source code, and PII enable further attacks, plus prevention via error handling and encryption.
blog · bishopfox.com
Traeger Grill D2 Wi-Fi Controller, Version 2.02.04
Bishop Fox found two vulnerabilities and two informational issues in the Traeger Grill D2 Wi-Fi Controller (2.02.04), including authorization flaws (CVSS 7.1) enabling control of others' grills.
blog · bishopfox.com
TaskCafe, Version 0.3.2 Advisory
Bishop Fox discloses three TaskCafe 0.3.2 vulnerabilities—improper access controls, stored XSS, and insecure file uploads—that chain to take over administrator accounts.
blog · bishopfox.com
Microsoft Intune, Version 1.55.48.0 Advisory
Advisory on Microsoft Intune 1.55.48.0: its Management Extension calls agentexecutor.exe unquoted, letting local users with write access run code as others; no fix is available.
blog · bishopfox.com
Atlassian Jira Align, Version 10.107.4 Advisory
Advisory on Atlassian Jira Align 10.107.4: an SSRF in Connector settings could leak the service account's AWS credentials, and a permission flaw let users elevate to Super Admin; fixed in 10.109.3.
Back