iTop (ITSM & CMDB) is a complete open source, ITIL, web based service management tool including a fully customizable CMDB, a helpdesk system and a document management tool. It is developed by Combodo and hosted on GitHub

We found a bypass to the CSRF function, which could be used to create a new administrator account or execute code remotely through a variation of the CVE-2018-10642 vulnerability (when an administrator account is targeted).

Compte tenu de la reprise de l’épidémie COVID-19 à l’échelle mondiale, nous avons dû prendre la lourde décision de reporter l’évènement annuel Hack In Paris qui aura lieu 28 juin au 2 juillet 2021, à la Maison de la Chimie.

Drag and Drop Multiple File Uploader is a simple, straightforward WordPress plugin extension for Contact Form7, which allows the user to upload multiple files using the drag-and-drop feature or the common browse-file of your webform.

We discovered a remote code execution vulnerability in this plugin, because the validation of dangerous file extensions fails.

User-Friendly USVN is a web interface written in PHP used to configure Subversion repositories.

We found a stored XSS vulnerability inside the commit module, that could allow an attacker to execute JavaScript into the client application and take over user web browsers.

User-Friendly USVN is a web interface written in PHP used to configure Subversion repositories.

We could execute code remotely, through an OS command injection inside the Timeline module. It can be used by an authenticated user to execute arbitrary command against the operating system.

Jeedom is a home automation solution used in IoT.

We discovered an XSS (cross-site-scripting) injection that can lead to a remote code execution.

A system command injection vulnerability has been introduced in the Atos-Magento module version 3.0.0. This module manage the remote ATOS payment solution for Magento 1.x (1.7+) e-commerce websites.

Découvrez les mesures mises en oeuvre pour assurer votre santé et votre sécurité lors de nos prestations d'audits

This article describes an exploitation path of PackageKit settings in Fedora/CentOS, to achieve local privilege escalation to root without any user interaction.

The scenario uses vulnerabilities in both the default configuration of PackageKit and some packages.

We found a way to escalate our privileges to root, exploiting a vulnerability in the way that a setsuid binary can be abused to load malicious Perl libraries.