Schneider Electric Modicon M340 Devices Buffer Overflow Vulnerability (SEVD-2015-344-01)

Schneider Electric Modicon M340 devices are prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com

Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...

SQL Injection Vulnerability in Haixie Zhikang Base Platform

Haixie Zhikang Basic Platform is a management system for food and beverage and pharmaceuticals. A SQL injection vulnerability exists in the Haixie Zhikang Basic Platform login, which can be exploited by attackers to obtain sensitive information from the website database...

WordPress: Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth

Description This report is a variant on report 110801 but with broader vector. 110801 was a XSRF SSRF that allowd unintended GET requests to 0.0.0.0 on port 80, 443 and 8080. This vulnerability uses same entry vector of the press this scrape function but entirely bypasses the ip and port filter...

SweetRice 1.5.1 Cross Site Request Forgery / Cross Site Scripting

alert1' alert1 3. Xss in Page Limit: Payload should inject in cookies. Vulnerable Parameter : pagelimit Headers : GET /as/?appmode=database&plugin=App&type=plugin& HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT 10.0; rv:49.0 Gecko/20100101 Firefox/49.0 Accept:...

SweetRice 1.5.1 - Arbitrary File Upload

/usr/bin/python -- Coding: utf-8 -- Exploit Title: SweetRice 1.5.1 - Unrestricted File Upload Exploit Author: Ashiyane Digital Security Team Date: 03-11-2016 Vendor: http://www.basic-cms.org/ Software Link: http://www.basic-cms.org/attachment/sweetrice-1.5.1.zip Version: 1.5.1 Platform: WebApp -...

SweetRice 1.5.1 - Arbitrary File Download Exploit

Exploit for php platform in category web applications /usr/bin/python -- Coding: utf-8 -- Exploit Title: SweetRice 1.5.1 - Local File Inclusion Exploit Author: Ashiyane Digital Security Team Date: 03-11-2016 Vendor: http://www.basic-cms.org/ Software Link:...

SSL Enabled Basic Auth Credential Harvester: phishery

An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document...

CERT Basic Fuzzing Framework: BFF

CERT Basic Fuzzing Framework The CERT Basic Fuzzing Framework BFF is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. Mutational fuzzing is the act of taking well-formed...

SUSE-SU-2016:2358-1 Security update for wget

This update for wget fixes the following issues: - CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed. bsc984060. - CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext and making them accessible to the current user only. bsc995964...

Microsoft Office Information Disclosure Vulnerability (CNVD-2016-07925)

Microsoft Office is a suite of office software products developed by Microsoft.Visual Basic macros is one of the programming languages dedicated to performing common automation OLE tasks in desktop applications. An information disclosure vulnerability exists in Visual Basic macros in Microsoft...

CVE-2016-3375

The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to...

CVE-2016-0141

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

Information disclosure

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

CVE-2016-0141

CVE-2016-0141 is a Microsoft Office information-disclosure vulnerability. The issue arises in Visual Basic macros for Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016, where saving a document exports a certificate-store private key. The underlying risk is exposure of the user’s private key to an att...

CVE-2016-0141

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."...

Debian DLA-604-1 : ruby-actionpack-3.2 security update

Multiple vulnerabilities have been discovered in ruby-actionpack-3.2, a web-flow and rendering framework and part of Rails : CVE-2015-7576 A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare...

Nextcloud: Information Disclosure of .htaccess file in Private Server/Subdomain

@ahsantahir reported a missing permission check on an internal service allowing the extraction of the .htaccess file. We've fixed this by adjusting the Apache configuration and putting Basic Auth in front of the page. On request of the reporter this is disclosed limitedly. Non-Critical, small...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to trigger service failures or execute arbitrary code.

The vulnerability of JScript 9, VBScript, and Chakra JavaScript in Microsoft Edge and Internet Explorer browsers is due to buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure memory corruption through a specially crafted web page...

Microsoft Edge browser vulnerability, which allows a hacker to obtain confidential information from the process memory

The vulnerability of the VBScript kernel in Microsoft Edge browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information from the process’s memory through a specially crafted web pa...