Vimeo: A user can edit comments even after video comments are disabled

A user can escalate privileges and edit his previous comments, when comments are disabled for a video. Steps to verify: 1. Log into vimeo.com as Alice. Upload a video say, video id - 118026546 and allow anyone to leave comments for that video . 2. Login as Bob and navigate to the video URL -...

X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps

It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...

D-Link DWR-113 Cross Site Request Forgery

Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE : CVE-2014-3136 Type of Application : Web...

Motorola SBG901 Wireless Modem - CSRF Vulnerability

No description provided by source. Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless modem Tested on : Windows ...

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery

Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless modem Tested on : Windows 7 CVE : CVE-2014-3778 Type of...

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless...

i-doit Pro 1.2.4 Cross Site Scripting

COMPASS SECURITY ADVISORY http://www.csnc.ch/ CVE ID : CVE-2014-1237 CSNC ID: CSNC-2014-002 Product: i-doit Vendor: synetics Gesellschaft für Systemintegration mbH Subject: Cross-site Scripting - XSS Risk: High Effect: Remotely exploitable Author: Stephan Rickauer [email protected] Date:...

Developing and Sharing Tools for Professional Hackers

Professional hackers or security testers tend to write a lot of code. We write exploit code, fuzzers, code to handle esoteric protocols and data structures, unpackers, disassemblers, reversers, parsers, and so much more. We write this code because often what we’re doing is so specific that is...

Concrete CMS 5.5.2.1 Logged-In Cross Site Scripting

TITLE ....... Concrete5.5.2.1 CMS is vulnerable to XSS for logged-in users DATE ........ 23.04.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://concrete5.org VERSION ..... 5.5.2.1 TESTED ON ... LAMP ----------------------------------------------------------------------- 1. What...