CVE-2019-9248

The CVE-2019-9248 entry concerns the Android kernel FingerTipS touchscreen driver, where a missing bounds check enables a local out-of-bounds write that can escalate privileges to System with no user interaction. Affected component: FingerTipS touchscreen driver in the Android kernel. Root cause:...

ghungroo.it Cross Site Scripting vulnerability

Security Researcher rcdxmlt Helped patch 64 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ghungroo.it website and its users. Following coordinated and responsible vulnerability...

zaalvoetbal-roermond.teamwebs.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-939893 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

admin.wyoung.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-922814 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting admin.wyoung.org website...

uriexpo.kr Cross Site Scripting vulnerability

Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting uriexpo.kr website and its users. Following coordinated and...

doc.boyo.org.tw Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-905422 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting doc.boyo.org.tw website and i...

milanaap-ar.com Cross Site Scripting vulnerability

Security Researcher TapanCyberExpert Helped patch 22 vulnerabilities Received 2 Coordinated Disclosure badges Received 1 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting milanaap-ar.com website and its users. Following...

www-cmar-per.vm.csiro.au Cross Site Scripting vulnerability

Security Researcher CoderYounes Helped patch 1033 vulnerabilities Received 5 Coordinated Disclosure badges Received 8 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting www-cmar-per.vm.csiro.au website and its users. Followi...

Telerik Web UI Information Disclosure (CVE-2017-9248)

A security bypass vulnerability exists in Telerik Web UI. Successful exploitation of this vulnerability can lead to cross-site scripting, arbitrary file uploads and downloads, leak of MachineKey and compromise of the ASP.NET ViewState on the affected system...

U.S. Dept Of Defense: RCE on https://█████/ Using CVE-2017-9248

Summary: https://█████████/ is hosting an unpatched version of the Telerik DialogHandler Telerik.Web.UI.DialogHandler.aspx allowing for the machine key to be brute forced. The machine key can be used to access the DNN file manager to upload arbitrary files including ASPX giving a web shell and RC...

bologna.bakeca.it XSS vulnerability

Open Bug Bounty ID: OBB-679423 Description| Value ---|--- Affected Website:| bologna.bakeca.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-9248

...

CVE-2016-9248

CVE-2016-9248 entry rejected; not an active vulnerability.

FiberHome VDSL2 Modem HG 150-UB - Authentication Bypass

Exploit Title: FiberHome VDSL2 Modem HG 150-UB Authentication Bypass Date: 04/03/2018 Exploit Author: Noman Riffat Vendor Homepage: http://www.fiberhome.com/ CVE : CVE-2018-9248, CVE-2018-9248 The vulnerability exists in plain text & hard coded cookie. Using any cookie manager extension, an...

CVE-2018-9248

CVE-2018-9248 affects FiberHome VDSL2 Modem HG 150-UB. The flaw allows authentication bypass via the HTTP cookie header “Cookie: Name=0admin” due to improper session handling and a hard-coded/plain-text cookie. Public evidence (NVD entry, CNVD-2018-08815, Exploit-DB entry) confirms the bypass can...

CVE-2017-9248

creationtimestamp| type| source ---|---|--- 2018-03-21 13:35:18+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/14891 2018-09-02 06:50:13+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/19908 2018-09-02 07:17:44+00:00|...

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Encryption Keys Disclosure

Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Encryption Keys Disclosure Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker Filename: dpcrypto.py Github: https://github.com/bao7uo/dpcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website:...

Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure

Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker Filename: dpcrypto.py Github: https://github.com/bao7uo/dpcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: Telerik UI for ASP.NET AJAX CVE: CVE-2017-9248 Vend...

CVE-2015-9248

Skybox Platform is affected by a stored cross-site scripting (XSS) in Change Manager. Multiple sources report this vulnerability in the web path /skyboxview/webskybox/tickets, with Skybox Platform versions prior to 7.5.201 (NVD) and prior to 7.5.401 (CNVD) being vulnerable. The issue concerns the...

CVE-2017-9248

CVE-2017-9248 affects Progress Telerik UI for ASP.NET AJAX (and Sitefinity) prior to R2 2017 SP1 / 10.0.6412.0. The vulnerability lies in Telerik.Web.UI.dll handling of the Telerik.Web.UI.DialogParametersEncryptionKey and the MachineKey, enabling an attacker to defeat cryptographic protection and...