CVE-2016-6877

Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an...

Firefox - SVG cross domain cookie vulnerability （CVE-2016-9078）

Original link: http://insert-script.blogspot.jp/2016/12/firefox-svg-cross-domain-cookie.html Author: the Alex Inführ Translation: Holic know Chong Yu 404 Safety laboratory , this article has additions and changes Note: the vulnerability only affects Firefox 49 and 50 version, details see the...

Sucuri: SSRF in sitecheck.sucuri.net

Hi, Sucuri Security Team. I found a SSRF in https://sitecheck.sucuri.net/ Although there was already an protection to prevent SSRF, but it can be bypassed by 302 redirection! ssrf.php https://sitecheck.sucuri.net/results/orange.tw/ssrf.php And your port will receive "HELLO WORLD" orange@z:$ nc -v...

Uber: XSS in uber oauth

Hi , I have found that when setting a redirecturi for an application you validate for the presence of :// in the beginning of the url , but you don't validate for the protocol and you don't block malicious protocols such as javascript: pseudo protocol and data: URIs. Although the redirecting is...

Fedora 24 : kernel-4.5.0-302.fc24 (2016-81fd1b03aa)

The 4.5.0-302 update contains a number of arm fixes, turns off DEBUGWX, and actually seems to boot on i686. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as mu...

X (Formerly Twitter): Bypassing callback_url validation on Digits

Hi, I would like to report an issue in Digits which allows attacker to bypass the callbackurl validation of an application and thus takeover an account. Detail Digits is a part of the Fabric SDK which offers phone-based sign in. It also provides web login flow. In the navigation-based...

Apple Safari URI spoofing (CVE-2015-5764)

tl;dr Apple Safari for OS X was prone to URI spoofing vulnerability and more general a user interface spoofing. Apple released security updates for Safari 9 on OS X and assigned CVE-2015-5764. Accidentally this vulnerability was also present in iOS. Instant demo In Safari up to 8.0.8 : go to clic...

Amazon Linux: Security Advisory (ALAS-2014-302)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malvertising Leads to Magnitude Exploit Kit, Ransomware Infection

Criminals are injecting malicious redirect code into advertisements in order to route user traffic toward sites hosting the Magnitude exploit kit, which, in turn, infects those users with strains of file-encrypting ransomware. Magnitude predominately relies on drive-by-download attacks in which i...

Fedora 21 : kernel-3.17.4-302.fc21 (2014-16448)

Small bugfix update. A few AArch64 fixes and a patch to quiet a common i915 warning. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 21 : kernel-3.17.1-302.fc21 (2014-13222)

Even more btrfs corruption/error fixes. Small b43 wireless regression fix. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducin...

OpenSupports 2.x - Auth Bypass/CSRF Vulnerabilities

No description provided by source. + Author: TUNISIAN CYBER + Exploit Title: OpenSupports v2.x AuthBypass/CSRF Vulnerabilities + Date: 15-03-2014 + Category: WebApp + Version: 2.x + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-302/CWE-89 + Vendor: http://www.opensupports.com/ + Friendly Sites:...

chillyCMS 1.3.0 - Multiple Vulnerabilities

No description provided by source. Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: powered by chillyCMS Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link:...

openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)

Update to Chromium 31.0.1650.63 Stable channel update : - Security fixes : - CVE-2013-6634: Session fixation in sync related to 302 redirects - CVE-2013-6635: Use-after-free in editing - CVE-2013-6636: Address bar spoofing related to modal dialogs - CVE-2013-6637: Various fixes from internal...

Slack: Facebook Takeover using Slack using 302 from files.slack.com with access_token

Hi, I noticed that your Facebook application used in the "Import Photo" can be used to take over the Facebook account of the user being attacked. It's multiple issues in one: 1. You have a 302 redirect from a .slack.com domain. Hash-values will follow the redirect. 2. The Facebook application OAu...

osCmax 2.5.X Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications + Author: TUNISIAN CYBER + Exploit Title: osCmax 2.5.X Cross-Site Request Forgery Add Admin Vulnerability + Date: 15-03-2014 + Category: WebApp + Version: 2.5.X + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-302 + Vendor: http://www.oscmax.co...

osCmax 2.5.x Cross Site Request Forgery

Author: TUNISIAN CYBER + Exploit Title: osCmax 2.5.X Cross-Site Request Forgery Add Admin Vulnerability + Date: 15-03-2014 + Category: WebApp + Version: 2.5.X + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-302 + Vendor: http://www.oscmax.com/ + Friendly Sites: na3il.com,th3-creative.com +...

OpenSupports 2.x - Authentication Bypass Cross-Site Request Forgery

OpenSupports 2.x - Authentication Bypass Cross-Site Request Forgery + Author: TUNISIAN CYBER + Exploit Title: OpenSupports v2.x AuthBypass/CSRF Vulnerabilities + Date: 15-03-2014 + Category: WebApp + Version: 2.x + Tested on: KaliLinux/Windows 7 Pro + CWE: CWE-302/CWE-89 + Vendor:...

Session fixation

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/oneclicksigninhelper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper...

Google Chrome < 31.0.1650.63 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 31.0.1650.63. It is, therefore, affected by the following vulnerabilities : - An error exists related to session fixation, the sync process and HTTP 302 redirects. CVE-2013-6634 - A use-after-free error exists related...