âSometimes I leave the back door open for my deaf and blind dog so he can enjoy what the neighbors are grilling.â
(Source)
he wasn't even looking at me and he found me
PUT YOUR BEARD IN MY MOUTH
art blog(derogatory)
d e v o n
Aqua Utopiaď˝ćľˇăŽĺşă§č¨ćśăç´Ąă
I'd rather be in outer space đ¸

oozey mess
hello vonnie

styofa doing anything
Misplaced Lens Cap

⣠Chile in a Photography âŁ
TVSTRANGERTHINGS
NASA
Cosimo Galluzzi
noise dept.

if i look back, i am lost
Game of Thrones Daily

seen from T1
seen from United States
seen from United States
seen from United States

seen from United Kingdom

seen from Malaysia
seen from United States
seen from China
seen from United States
seen from United States

seen from TĂźrkiye

seen from T1

seen from Greece
seen from United States
seen from Bulgaria

seen from United States

seen from T1
seen from United Kingdom

seen from United States
seen from United Kingdom
@mathpost
âSometimes I leave the back door open for my deaf and blind dog so he can enjoy what the neighbors are grilling.â
(Source)

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
Roasted Potatoes and Kielbasa (One-Pan Recipe)
Really nice recipes. Every hour.
Show me what you cooked!
An eye-opening perspective (Source)
The Subtle Pythagoras Theorem
Pythagoras famously quoted:
Do not say a little in many words but a great deal in a few
And his theorem is a draconian illustration of these words.
* This happens to be one of my favorite proofs of the theorem, but feel free to explore the legion others that are in existence, like this one :
Good Day!
bezier gauze

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
大ĺŚçćŻä¸čŽşć莞莥ďźĺšłé˘ĺžçDunbarçćł
â˘ĺŚĺˇďźPB06001074 â˘ĺ§ĺďźçćś â˘ĺš´çş§ďź06çş§ â˘çłťĺŤďźć°ĺŚçłť â˘ĺŽććĽćďź2010ĺš´6ć â˘ć察ćĺ¸ďźĺžäżć â˘ĺŚć Ąďźä¸ĺ˝ç§ĺŚććŻĺ¤§ĺŚ
ćčŚďź 寚ä¸ä¸Şé犺ĺžGďźgraphďźďź ĺŚćGä¸çćŻä¸ä¸ŞéĄśçšé˝ĺ¨D ä¸ćč ä¸Gç饜çšç¸čżďźéŁäš D尹袍称为é犺ĺžçć§ĺśé ďźdominating setďźďźćĺ°ç ć§ĺść°ďźdominating numberďź ć䝏尹ç¨ÎłďźGďźčĄ¨ç¤şă莞E为 为Gçä¸ä¸ŞčžšçéĺďźĺŚćG- Eçć§ĺść°ĺ¤§äşGçć§ĺść°ďź éŁäšćĺ°çéĺEä¸čžšçć°çŽ ĺ°ąç§°ä¸şćçźć°bďźGďź ďźbondage numberďźăćčŚKang ĺ Yuan ćžčŻć čżĺŻšäťťćčéçĺšłé˘ĺž GćĽčŻ´ b(G)â¤8ă Carlson ĺ Develin ć äžčżä¸ä¸ŞçŽĺďźĺĺ§ç čŻćďźĺ˝G为嚳é˘ĺžćś b(G)⤠min{8, âł(G)+2}ă ĺ¨ćŹćä¸ďźć䝏ĺ°ĺ°čŻ čŻćDunbarçčĺçćł b(G) ⤠âł+1ďźçąäşčŻć ćŹčşŤĺ°éžďźć䝏ĺ°ĺ č čé¨ĺć ĺľďźĺ°ąćŻčżé ĺšłé˘ĺžďźä¸ć¤ĺćśďźć 䝏ĺ°ĺŞččâłâ¤3ççšćŽ ć ĺľă
Abstract: Given a nonempty graph G, a set D of its vertices is a dominating set if every vertex of G is in D or adjacent to a vertex in D. The dominating number Îł(G) of a graph G is defined t be the minumum size of a dominating set of G. If E is a edge set of G, the bondage number b(G) of a nonempty graph is defined to be the cardinality of the smallest set E of edges of G such that the graph G-E has domination number greater than that of G.Kangâ and Yuan proved b(G)â¤8 for every connected planar graph G. Carlson and Develin presented a simple, intuitive proof that b(G)⤠min{8, âł(G)+2}for all planar graphs G. In this paper, we conject that b(G) ⤠âł+1 when 3â¤âłâ¤6. Since it is not very easy, we will consider âłâ¤3 first especially for a connected planar graph.
ĺ łéŽčŻďźćçźć°ďźbondage numberďźďźć§ĺść° ďźdomination numberďźďźčżéçĺšłé˘ĺž ďźconnected planar graphďźďźĺşŚďźdegreeďźďźéĄś çšďźvertexďź
ćŹ ć 丝 čŚ ĺ 厚珏ä¸çŤ 丝čŚäťçťçćŻćŹćçčćŻçĽčŻďźäťĽ ĺĺ łäşćçźć°çç 犜ĺç¨ĺä¸äšç¸ĺ łçé¨ ĺćçŽďźäťĽĺç°ĺ¨çç 犜ç°çśă珏äşçŤ ĺ饞äşä¸ćçźć°ćĺ łçç 犜ććďź ä¸ťčŚçťčŽşçĺ丞ďźäťĽĺćŹćĺŻč˝ç¨çç é¨ĺ丝čŚçťčŽşă珏ä¸çŤ ĺ为ćŹććśĺç丝čŚčŻć䝼ĺçćłĺćŹćĺŻč˝ç ĺşç¨
http://www.slideshare.net/greentask/dunbars-conjecture-for-planar-graphs
In the geometry of mariners, where straight lines are Great Circles, the angle sum of a triangle is more than 180 degrees.
The Gamma Functionâs integral definition and one of its properties translated to Gallifreyan mathematics. This took me a few hours.
The reason why Involute gears turn smoothly. Fig 1) How to draw involute of circle. Fig 2&3) Move and rotate the observing point. Fig 4&5) The curves are tangent. Fig 6)Â Involute gears turn smoothly.
The Quaternion Group
Just as Complex Numbers are a 2-Dimensional extension of the Real Numbers, Quaternions are a 4-Dimensional extension of Real and Complex Numbers. And just as you can describe how to make the Complex Numbers from the Reals using the group Z/4Z, you can describe how to make Quaternions using something called the Quaternion Group, denoted Q3.
The main structure is that you have 3 different elements, Â {i, j, k}, which behave similarly, in that i2=j2=k2= -1. But you also define multiplication between them. This actually has to be non-commutative, to make things work out, so ij=k, but ji= -k, etc. A helpful diagram is if you go forward in the following figure, you keep it positive, but if you go backwards, you use a negative.
There are 2 elements that commute with every element in the Quaternion group, namely {1, -1}. This is called the center of the group, denoted Z(Q3), from the German Zentrum.
This is multiplication by i on the left
And this is multiplication by i on the right
If you notice that with all Q3âs subgroups, even though some cosets are different if you multiply by the left or right, the left and right cosets have the same elements, which makes every subgroup of Q3 a Normal subgroup. (This is not true of all subgroups of all groups, but this oneâs special)
Example with subgroup J= {1, j, -1, -j}
This is the left coset iJ
This is the right coset Ji
For completenessâs sake, here is the same thing with k
Just to make the next part easier, I will display Q3 in a new format that puts elements which are just inverses of each other close together.
And then, if you take the quotient group Q3/{1, -1}, or contract the group by putting together groups that are inverses of each otherâŚ
You get the Klein 4-Group!
(This form of showing groups is called the Cayley graph)
(Quaternions are actually really great at describing motion in 3 or 4 dimensions, and the reason you need them for 3 is that this kind of system only works in dimensions that are powers of 2)

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
Need some help with factoring?
Worksheets:Â
 Feel free to download and print the sheets on either side of the banner. On the left, I have filled out the blanks, so you can either print that copy out, or print out the empty sheet and use my notes to fill out the sheet on the right! Also, where it says âNo Coefficient,â Iâm talking about a leading coefficient of one. However, that didnât sound as catchy on the sheet :) âWith Coefficientâ means that the leading coefficient is greater than one or less than zero. The sheets arenât very detailed because they were meant for my own personal use, so please feel free to ask me anything about them/the subjects!
Links:Â
Khan Academy: Factoring Quadratics with a Leading Coefficient of One
 I recommend poking around other Khan Academy videos/resources as well
Factoring: A Complete Overview
Multiplying Binomials, Quadratic Trinomials: Lesson and Practice
This site has a lot of really great lessons, and having the additional practice is nice, as well!
Factoring Trinomials: Lesson and Practice
Practice Factoring Polynomial Expressions:Â (Part One)Â (Part Two)
Polynomial Factoring Calculator with Explanation
Another (More General) Calculator Â
Let me know if you think I should add anything! I hope this helps!
The New York Times  Old Articles Can Be Exploited by XSS Attacks (Almost all Article Pages Before 2013 Are Affected)
Domain: http://www.nytimes.com/ âThe New York Times (NYT) is an American daily newspaper, founded and continuously published in New York City since September 18, 1851, by the New York Times Company. It has won 114 Pulitzer Prizes, more than any other news organization. The paperâs print version has the largest circulation of any metropolitan newspaper in the United States, and the second-largest circulation overall, behind The Wall Street Journal. It is ranked 39th in the world by circulation. Following industry trends, its weekday circulation has fallen to fewer than one million daily since 1990. Nicknamed for years as âThe Gray Ladyâ, The New York Times is long regarded within the industry as a national ânewspaper of recordâ. It is owned by The New York Times Company. Arthur Ochs Sulzberger, Jr., (whose family (Ochs-Sulzberger) has controlled the paper for five generations, since 1896), is both the paperâs publisher and the companyâs chairman. Its international version, formerly the International Herald Tribune, is now called the International New York Times. The paperâs motto, âAll the News Thatâs Fit to Printâ, appears in the upper left-hand corner of the front page.â (Wikipedia) (1) Vulnerability Description: The New York Times has a computer cyber security problem. Hacker can exploit its users by XSS bugs. The code program flaw occurs at New York Timesâs URLs. Nytimes (short for New York Times) uses part of the URLs to construct its pages. However, it seems that Nytimes does not filter the content used for the construction at all before 2013. Based on Nytimesâs Design, Almost all URLs before 2013 are affected (All pages of articles). In fact, all article pages that contain âPRINTâ button, âSINGLE PAGEâ button, âPage *â button, âNEXT PAGEâ button are affected. Nytimes changed this mechanism since 2013. It decodes the URLs sent to its server. This makes the mechanism much safer now. However, all URLs before 2013 are still using the old mechanism. This means almost all article pages before 2013 are still vulnerable to XSS attacks. I guess the reason Nytimes does not filter URLs before is cost. It costs too much (money & human capital) to change the database of all posted articles before.
Discover and Reporter: Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing More Details: http://lists.openwall.net/full-disclosure/2014/10/16/2 http://www.tetraph.com/blog/xss-vulnerability/new-york-times-xss http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1102 http://webcabinet.tumblr.com/post/121907302752/new-york-times-xss http://www.inzeed.com/kaleidoscope/xss-vulnerability/new-york-times-xss http://webtech.lofter.com/post/1cd3e0d3_6f57c56 http://tetraph.blog.163.com/blog/static/2346030512014101270479/ https://vulnerabilitypost.wordpress.com/2014/11/01/new-york-times-xss http://lifegrey.tumblr.com/post/121912534859/tous-les-liens-vers-les-articles http://securityrelated.blogspot.com/2014/10/new-york-times-design.html https://mathfas.wordpress.com/2014/11/01/new-york-times-xss http://computerobsess.blogspot.com/2014/10/new-york-times-design.html http://whitehatview.tumblr.com/post/103788276286/urls-to-articles-xss http://diebiyi.com/articles/security/xss-vulnerability/new-york-times-xss
The Weather Channel at Least 76.3% Links Vulnerable to XSS Attacks Domain Description:  http://www.weather.com/ âThe Weather Channel is an American basic cable and satellite television channel which broadcasts weather forecasts and weather-related news and analyses, along with documentaries and entertainment programming related to weather.  Launched on May 2, 1982, the channel broadcasts weather forecasts and weather-related news and analysis, along with documentaries and entertainment programming related to weather.âÂ
 âAs of February 2015, The Weather Channel was received by approximately 97.3 million American households that subscribe to a pay television service (83.6% of U.S. households with at least one television set), which gave it the highest national distribution of any U.S. cable channel. However, it was subsequently dropped by Verizon FiOS (losing its approximately 5.5 millions subscribers), giving the title of most distributed network to HLN. Actual viewership of the channel averaged 210,000 during 2013 and has been declining for several years. Content from The Weather Channel is available for purchase from the NBCUniversal Archives.â (Wikipedia) Vulnerability description: The Weather Channel has a cyber security problem. Hacker can exploit it by XSS bugs.Â
 Almost all links under the domain weather.com are vulnerable to XSS attacks. Attackers just need to add script at the end of The Weather Channelâs URLs. Then the scripts will be executed.Â
 10 thousands of Links were tested based a self-written tool. During the tests, 76.3% of links belong to weather.com were vulnerable to XSS attacks.Â
 The reason of this vulnerability is that Weather Channel uses URLs to construct its HTML tags without filtering malicious script codes. The vulnerability can be attacked without user login. Tests were performed on Firefox (34.0) in Ubuntu (14.04) and IE (9.0.15) in Windows 8.
Discovered by: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing) http://www.tetraph.com/wangjing
More Details: http://seclists.org/fulldisclosure/2014/Nov/89 http://lists.openwall.net/full-disclosure/2014/11/27/3 http://whitehatview.tumblr.com/post/104313615841/the-weather-channel-flaw http://www.inzeed.com/kaleidoscope/xss-vulnerability/the-weather-bug http://diebiyi.com/articles/security/the-weather-channel-bug http://whitehatpost.lofter.com/post/1cc773c8_6f2d4a8 https://vulnerabilitypost.wordpress.com/2014/12/04/the-weather-channel-flaw http://tetraph.blog.163.com/blog/static/234603051201411475314523/ http://tetraph.blogspot.com/2014/12/the-weather-channel-xss.html http://ithut.tumblr.com/post/121916595448/weather-channel-xss https://mathfas.wordpress.com/2014/12/04/the-weather-channel-weather-bug http://computerobsess.blogspot.com/2014/12/the-weather-channel-xss.html http://www.tetraph.com/blog/xss-vulnerability/the-weather-channel-bug
Math and Computer & Web Security - Cryptography
A military commander wants some assurance that the information sent to field commanders does not fall into the hands of opponents. Hence, written communications which can be easily read if intercepted by an an enemy are dangerous. (Asking the messenger to memorize secret messages is not practical, and if one can believe the spy and counter-terrorism thrillers currently on TV, not secure.) Julius Caesar is often credited with one of the earlier attempts at using a cryptological system with a mathematical flavor to disguise messages. It is claimed that he used a system in which each letter of the alphabet in a "plaintext," the original message, is replaced by the next letter of the alphabet, with the last alphabet letter cycling around to be represented by the first letter of the alphabet. Thus, the phrase Caesar Cipher would be replaced by Dbftbs Djqifs. Coming across a message such as this, one is faced with the tremendous range of possible systems that might have been used to disguise the original message. It might confuse the "enemy" for a while. Within the range of what today have come to be called Caesar Ciphers, one could shift the replacement alphabet by r places, rather than 1 place (r =1) in the example above. When r = 5 the phrase Caesar Cipher becomes hfjxfw hnumjw.
More: http://mathstopic.blogspot.com/2015/06/math-and-computer-web-security.html
Lofter: http://mathdaily.lofter.com/post/1cc75b20_738efaf
securitypost:
CVE-2014-8753 Â Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities
Exploit Title: Cit-e-Net Multiple XSS (Cross-Site Scripting) Web Security Vulnerabilities
Product: Cit-e-Access
Vendor: Cit-e-Net
Vulnerable Versions: Version 6
Tested Version: Version 6
Advisory Publication: February 12, 2015
Latest Update: June 01, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-8753
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Author: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)
Instruction Details:
(1) Vendor & Product Description:
Vendor:
Cit-e-Net
Product & Version:
Cit-e-Access
Version 6
Vendor URL & Download:
Cit-e-Net can be downloaded from here, https://www.cit-e.net/citeadmin/help/cntrainingmanualhowto.pdf http://demo.cit-e.net/ http://www.cit-e.net/demorequest.cfm http://demo.cit-e.net/Cit-e-Access/ServReq/?TID=1&TPID=17
Product Introduction:
âWe are a premier provider of Internet-based solutions encompassing web site development and modular interactive e-government applications which bring local government, residents and community businesses together.
Cit-e-Net provides a suite of on-line interactive services to counties, municipalities, and other government agencies, that they in turn can offer to their constituents. The municipal government achieves a greater degree of efficiency and timeliness in conducting the daily operations of government, while residents receive improved and easier access to city hall through the on-line access to government services.
Our web-based applications can help your municipality to acheive its e-government goals. Type & click website content-management empowers the municipality to manage the website quickly and easily. Web page styles & formats are customizable by the municipality, and because the foundation is a database application, user security can be set for individual personnel and module applications. Our application modules can either be integrated into your existing municipal web site or implemented as a complete web site solution. Itâs your choice! Please contact us at [email protected] to view a demonstration of our municipal web site solution if you are an elected official or member of municipal management and your municipality is looking for a cost efficient method for enhancing & improving municipal services.
Interactive Applications
Online Service Requests
Online Tax Payments by ACH electronic-check or credit card.
Online Utility Payments by  ACH electronic-check or credit card.
Online General-Payments by ACH electronic-check or credit card.
Submit Volunteer Resumeâs Online for the municipality to match your skills with available openings.â
(2) Vulnerability Details:
Cit-e-Access web application has a security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a userâs browser session within the trust relationship between their browser and the server.
Several similar products 0Day vulnerabilities have been found by some other bug hunter researchers before. Cit-i-Access has patched some of them. Open Sourced Vulnerability Database (OSVDB) is an independent and open-sourced database. The goal of the project is to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The project promotes greater, open collaboration between companies and individuals. It has published suggestions, advisories, solutions details related to important vulnerabilities and cyber intelligence.
(2.1) The first programming code flaw occurs at â/eventscalendar/index.cfm?â page with â&DIDâ parameter in HTTP GET.
(2.2) The second programming code flaw occurs at â/search/index.cfm?â page with â&keywordâ parameter in HTTP POST.
(2.3) The third programming code flaw occurs at â/news/index.cfmâ page with â&jump2â â&DIDâ parameter in HTTP GET.
(2.4) The fourth programming code flaw occurs at âeventscalendar?â page with â&TPIDâ parameter in HTTP GET.
(2.5) The fifth programming code flaw occurs at â/meetings/index.cfm?â page with â&DIDâ parameter in HTTP GET.
(3) Solutions:
Leave message to vendor. No response. http://www.cit-e.net/contact.cfm
References: http://seclists.org/fulldisclosure/2015/Feb/48 http://marc.info/?l=full-disclosure&m=142380271819297&w=4 https://packetstormsecurity.com/files/130392/Cit-e-Net-6 https://hackertopic.wordpress.com/2015/06/06/cve-2014-8753 https://www.facebook.com/permalink.php?story_fbid=746137642163648 http://mathswift.blogspot.com/2015/06/cve-2014-8753.html http://inzeed.tumblr.com/post/120907933886/securitypost-cve-2014-8753 https://plus.google.com/u/0/100242269120759811496/posts/M5W1kShGpKr https://twitter.com/essayjeans/status/607391837213458432 http://ittechnology.lofter.com/post/1cfbf60d_735a4d0 http://www.weibo.com/5099722551/Clqtl3zWs?from=page_1005055099722551 http://blog.163.com/greensun_2006/blog/static/11122112201557115414537/ http://japanbroad.blogspot.jp/2015/06/cve-2014-8753-cit-e-net https://www.facebook.com/permalink.php?story_fbid=43609503322 http://whitehatpost.lofter.com/post/1cc773c8_73568f4 https://dailymem.wordpress.com/2015/06/06/cve-2014-8753 http://itinfotech.tumblr.com/post/120907872116/securitypost-cve-2014-8753 https://progressive-comp.com/?l=full-disclosure&m=142380271819297&w=1 http://www.tetraph.com/blog/xss-vulnerability/cve-2014-8753

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
itinfotech:
About Group (about.com) All Topics (At least 99.88% links) Vulnerable to XSS & Iframe Injection Security Attacks, About.com Open Redirect Web Security Vulnerabilities
Vulnerability Description: About.com all âtopic sitesâ are vulnerable to XSS (Cross-Site Scripting) and Iframe Injection (Cross Frame Scripting) attacks. This means all sub-domains of about.com are affected. Based on a self-written program, 94357 links were tested. Only 118 links do not belong to the topics (Metasites) links. Meanwhile, some about.com main pages are vulnerable to XSS attack, too. This means no more than 0.125% links are not affected. At least 99.875% links of About Group are vulnerable to XSS and Iframe Injection attacks. In fact, for about.comâs structure, the main domain is something just like a cover. So, very few links belong to them.
Simultaneously, the About.com main pageâs search field is vulnerable to XSS attacks, too. This means all domains related to about.com are vulnerable to XSS attacks.
For the Iframe Injection vulnerability. They can be used to do DDOS (Distributed Denial-of-Service Attack) to other websites, too. Here is one example of DDOS based on Iframe Injection attacks of others. http://www.incapsula.com/blog/world-largest-site-xss-ddos-zombies.html
In the last, some âOpen Redirectâ vulnerabilities related to about.com are introduced. There may be large number of other Open Redirect Vulnerabilities not detected. Since About.com are trusted by some the other websites. Those vulnerabilities can be used to do âCovert Redirectâ to these websites.
Vulnerability Disclosure: Those vulnerabilities were reported to About on Sunday, Oct 19, 2014. No one replied. Until now, they are still unpatched.
Vulnerability Discover: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@Justqdjing) http://www.tetraph.com/wangjing
(1) Some Basic Background
(1.1) Domain Description: http://www.about.com/ http://www.alexa.com/siteinfo/about.com
âFor March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month.â (The New York Times)
âAbout.com, also known as The About Group (formerly About Inc.), is an Internet-based network of content that publishes articles and videos about various subjects on its âtopic sites,â of which there are nearly 1,000. The website competes with other online resource sites and encyclopedias, including those of the Wikimedia Foundation, and, for March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month. As of August 2012, About.com is the property of IAC, owner of Ask.com and numerous other online brands, and its revenue is generated by advertising.â (Wikipedia)
âAs of May 2013, About.com was receiving about 84 million unique monthly visitors.â (TechCrunch. AOL Inc.)
âAccording to Aboutâs online media kit, nearly 1,000 âExpertsâ (freelance writers) contribute to the site by writing on various topics, including healthcare and travel.â (About.com)
(1.2) Topics Related to About.com
"The Revolutionary About.com Directory and Community Metasite. Hundreds of real live passionate Guides covering Arts, Entertainment, Business, Industry, Science, Technology, Culture, Health, Fitness, Games,Travel, News, Careers, Jobs, Sports, Recreation, Parenting, Kids, Teens, Moms, Education, Computers, Hobbies and Local Information.â (azlist.about.com)
About.com - Sites A to Z
Number of Topics
A: 66
B: 61
C: 118
D: 49
E: 33
F: 57
G: 39
H: 48
I: 32
J: 15
K: 13
L: 36
M: 70
N: 26
O: 23
P: 91
Q: 4
R: 32
S: 104
T: 47
U: 12
V: 9
W: 43
X: 1
Y: 4
Z: 1
SUM: 1039
Reference: azlist.about.com/
In fact, those are not all topics of about.com. Some of the topics are not listed here such as, http://specialchildren.about.com
So, there are more than 1000 topics related to about.com.
(1.3) Result of Exploiting XSS Attacks XSS may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a userâs browser session within the trust relationship between their browser and the server. Base on Acunetix, exploited XSS is commonly used to achieve the following malicious results:
 "Identity theft
 Accessing sensitive or restricted information
 Gaining free access to otherwise paid for content
 Spying on userâs web browsing habits
 Altering browser functionality
 Public defamation of an individual or corporation
 Web application defacement
 Denial of Service attacks (DOS)
â (Acunetix)
⌠âŚ
More: http://seclists.org/fulldisclosure/2015/Feb/9
Related Articles: http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1547 http://marc.info/?l=full-disclosure&m=142289980219878&w=4 https://packetstormsecurity.com/files/130211/About.com-Cross-Site-Scripting.html http://computerobsess.blogspot.com/2015/06/about-group-aboutcom-all-topics-at.html https://www.facebook.com/computersecurities/posts/384674738385985 http://www.weibo.com/1644370627/Clk7CaKvL?from=page_1005051644370627 http://guyuzui.lofter.com/post/1ccdcda4_6f03224 https://twitter.com/yangziyou/status/607145647037284352 http://webtechhut.blogspot.com/2015/06/about-group-aboutcom-all-topics-at.html https://computertechhut.wordpress.com/2015/02/02/about-group-about-com- https://www.facebook.com/permalink.php?story_fbid=1043670099006327 http://inzeed.tumblr.com/post/118845379331/securitypost-about-group-99-88-xss https://dailymem.wordpress.com/2015/02/11/about-group http://mathdaily.lofter.com/post/1cc75b20_7340000 http://xingti.tumblr.com/post/120847740060/itinfotech-about-group-xss-xfs http://diebiyi.com/articles/security/xss-vulnerability/about-group-xss-xrf-open-redirect/ http://www.tetraph.com/blog/xss-vulnerability/about-group-xss-xrf-open-redirect/
CNN Travel.cnn.com XSS and Ads.cnn.com Open Redirect Web Security Vulnerabilities
Domain: cnn.com
âThe Cable News Network (CNN) is an American basic cable and satellite television channel that is owned by the Turner Broadcasting System division of Time Warner. The 24-hour cable news channel was founded in 1980 by American media proprietor Ted Turner. Upon its launch, CNN was the first television channel to provide 24-hour news coverage, and was the first all-news television channel in the United States. While the news channel has numerous affiliates, CNN primarily broadcasts from the Time Warner Center in New York City, and studios in Washington, D.C. and Los Angeles, its headquarters at the CNN Center in Atlanta is only used for weekend programming. CNN is sometimes referred to as CNN/U.S. to distinguish the American channel from its international sister network, CNN International. As of August 2010, CNN is available in over 100 million U.S. households. Broadcast coverage of the U.S. channel extends to over 890,000 American hotel rooms, as well as carriage on cable and satellite providers throughout Canada. Globally, CNN programming airs through CNN International, which can be seen by viewers in over 212 countries and territories. As of February 2015, CNN is available to approximately 96,289,000 cable, satellite and, telco television households (82.7% of households with at least one television set) in the United States.â (Wikipedia)
Discovered and Reported by: Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. Â (@justqdjing) http://www.tetraph.com/wangjing/
Vulnerability Description: CNN has a cyber security bug problem. It cab be exploited by XSS (Cross Site Scripting) and Open Redirect (Unvalidated Redirects and Forwards) attacks.
Based on news published, CNN users were hacked based on both Open Redirect and XSS vulnerabilities. According to E Hacker News on June 06, 2013, (@BreakTheSec) came across a diet spam campaign that leverages the open redirect vulnerability in one of the top News organization CNN. After the attack, CNN takes measures to detect Open Redirect vulnerabilities. The measure is quite good during the tests. Almost no links are vulnerable to Open Redirect attack on CNNâs website, now. It takes long time to find a new Open Redirect vulnerability that is un-patched on its website.
CNN.com was hacked by Open Redirect in 2013. While the XSS attacks happened in 2007.
<1>Â There are some tweets complaining about hacked with links from CNN.
At the same time, the cybercriminals have also leveraged a similar vulnerability in a Yahoo domain to trick users into thinking that the links point to a trusted website.
Yahoo Open Redirects Vulnerabilities: http://securityrelated.blogspot.com/2014/12/yahoo-yahoocom-yahoocojp-open-redirect.html
<2>Â CNN.com XSS hacked http://seclists.org/fulldisclosure/2007/Aug/216
Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. CNN has patched some of them. BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. The below things be posted to the Bugtraq list: (a) Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other). (b) Exploit programs, scripts or detailed processes about the above. Š Patches, workarounds, fixes. (d) Announcements, advisories or warnings. (e) Ideas, future plans or current works dealing with computer/network security. (f) Information material regarding vendor contacts and procedures. (g) Individual experiences in dealing with above vendors or security organizations. (h) Incident advisories or informational reporting. (i) New or updated security tools. A large number of the fllowing web securities have been published here, Buffer overflow, HTTP Response Splitting (CRLF), CMD Injection, SQL injection, Phishing, Cross-site scripting, CSRF, Cyber-attack, Unvalidated Redirects and Forwards, Information Leakage, Denial of Service, File Inclusion, Weak Encryption, Privilege Escalation, Directory Traversal, HTML Injection, Spam. It also publishes suggestions, advisories, solutions details related to XSS and URL Redirection vulnerabilities and cyber intelligence recommendations.
Detail: http://seclists.org/fulldisclosure/2014/Dec/128
Related Articles: https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01507.html https://packetstormsecurity.com/files/129754/cnn-xssredirect.txt http://cxsecurity.com/issue/WLB-2014120196 https://progressive-comp.com/?l=full-disclosure&m=141988778706126&w=1 https://itinfotechnology.wordpress.com/2015/01/01/cnn-travel-cn http://russiapost.blogspot.com/2015/06/cnn-travelcnncom-xss https://www.facebook.com/permalink.php?story_fbid=745810602196352 http://www.weibo.com/5337321538/Clij19Krr?from=page_1005055337321538 https://plus.google.com/u/0/112682696109623633489/posts/TyipiFnULRj http://webcabinet.tumblr.com/post/116075198227/ithut-cnn-cnn http://mathdaily.lofter.com/post/1cc75b20_4f0a751 https://twitter.com/tetraphibious/status/607085555776561152 http://qianqiuxue.tumblr.com/post/120838173915/ithut-cnn-xss-url-redirection-bug http://itprompt.blogspot.com/2015/06/cnn-travelcnncom-xss https://www.facebook.com/permalink.php?story_fbid=891722397533572 http://tetraph.com/security/xss-vulnerability/cnn-xss-url-redirect-bug/ http://ittechnology.lofter.com/post/1cfbf60d_7338770 https://hackertopic.wordpress.com/2015/01/04/cnn-travel-cnn http://www.inzeed.com/kaleidoscope/xss-vulnerability/cnn-xss-url-redirect-bug/