CVE-2019-15635

CVE-2019-15635 affects Grafana 5.4.0: passwords for data sources (e.g., MySQL) are stored unencrypted and can be exposed. An admin can reveal these credentials by using the Save and test button in a data source’s settings, watching the traffic, or using the browser’s Show password option. The con...

CVE-2019-15635

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

Zomato: Information Disclosure through Sentry Instance ███████

Hello team I found a bug sensitive information can be used from attackers to perfom attack in youre server I don't know if this in scope so i'm sorry if i'm wrrong withou spending youre time here the steps how i found this bug : 1-Please use burp suite to reproduce the same result 2-i notice you...

College-Management-System 1.2 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: College-Management-System 1.2 - Authentication Bypass Author: Cakes Vendor Homepage: https://github.com/ajinkyabodade/College-Management-System Software Link:...

Ticket-Booking 1.4 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Ticket-Booking 1.4 - Authentication Bypass Author: Cakes Vendor Homepage: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking Software Link: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking/archive/master.zip Tested Version...

PortSwigger Web Security: Clicking "http://burp" hyperlink on FireFox CA Installation guide redirects to "burp.com" (unclaimed website).

Executive Summary --------------------------------------------------- I was in the process of installing Burp suite community edition on my recent machine where I believe I stumbled across a potential open redirect issue on the CA certificate installation website. This is a security concern due t...

Ticket-Booking 1.4 - Authentication Bypass

Exploit Title: Ticket-Booking 1.4 - Authentication Bypass Author: Cakes Discovery Date: 2019-09-14 Vendor Homepage: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking Software Link: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking/archive/master.zip Tested Version: 1.4 Tested on OS: CentOS ...

Ticket-Booking 1.4 Authentication Bypass

Exploit Title: Ticket-Booking 1.4 - Authentication Bypass Author: Cakes Discovery Date: 2019-09-14 Vendor Homepage: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking Software Link: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking/archive/master.zip Tested Version: 1.4 Tested on OS: CentOS ...

College-Management-System 1.2 Authentication Bypass

Exploit Title: College-Management-System 1.2 - Authentication Bypass Author: Cakes Discovery Date: 2019-09-14 Vendor Homepage: https://github.com/ajinkyabodade/College-Management-System Software Link: https://github.com/ajinkyabodade/College-Management-System/archive/master.zip Tested Version: 1....

Learn Ethical Hacking Online – A to Z Training Bundle 2019

Good news for you is that this week's THN Deals brings Ethical Hacking A to Z Bundle that let you get started regardless of your experience level. The Ethical Hacking A to Z Bundle will walk you through the very basic skills you need to start your journey towards becoming a professional ethical...

HTTP Request Smuggler - Extension For Burp Suite Designed To Help You Launch HTTP Request Smuggling Attacks

This is an extension for Burp Suite designed to help you launch HTTP Request Smuggling attacks, originally created during HTTP Desync Attacks research. It supports scanning for Request Smuggling vulnerabilities and also aids exploitation by handling cumbersome offset-tweaking for you. Install The...

IPRotate - Extension For Burp Suite Which Uses AWS API Gateway To Rotate Your IP On Every Request

Extension for Burp Suite which uses AWS API Gateway to change your IP on every request. More info: https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/ Description This extension allows you to easily spin up API Gateways across multiple regions. All the Burp Suite traffic for the...

Coda: Use Github pack with Coda employee github account (search code of Coda's private repositories)

Summary: When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula Github..CodeSearch, the version of the Github...

Automattic: Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fm

Steps: 1. Go to https://app.crowdsignal.com/dashboard and click Create a New Quiz 2. Add Multiple Choice to your page and click image button, upload a photo and click upload. 3. Start the burp suite and click Save button. Look at the request poc1.png and you will see mediacode= parameter. It will...

U.S. Dept Of Defense: [█████] Reflected GET XSS (/personnel.php?...&rcnum=*) with mouse action

I will combine this vulnerability with this vulnerability described in this report 648222. If you have not read this report, I recommend reading that report first, and then studying this report. I want to note that this report cannot be closed as a duplicate to the above described report. why?...

U.S. Dept Of Defense: [███████] Reflected GET XSS (/mission.php?...&missionDate=*)

I will combine this vulnerability with this vulnerability described in this report 648222. If you have not read this report, I recommend reading that report first, and then studying this report. I want to note that this report cannot be closed as a duplicate to the above described report. why?...

Kartpay: Reflected XSS on https://merchant.kartpay.com/payment_settings [status]

Vulnerable URL https://merchant.kartpay.com/paymentsettings/type Parameter status Payload " Steps to Reproduce 1. Login with your credentials. 2. Go to https://merchant.kartpay.com/paymentsettings 3. Start Burp suite proxy and intercept on. 4. Click on Run and Save button. intercept the request. ...

Trellix: Vulnerability Report: NO RATE LIMIT Password RESET

A vulnerability was found where there was no limit to the number of password reset requests that could be sent to a user. This could allow an attacker who obtained a user's session to send an unlimited number of OTPs to the user, potentially leading to denial of service...

U.S. Dept Of Defense: Remote OS command Execution in the 3 more Oracle Weblogic on the ████████, ████, ███████ [CVE-2017-10352]

Description Hello. I was able to identify 3 more RCE vulnerabilities due to the outdated Oracle Weblogic instance on the █████████, ███, █████ After my previous discoveries I decided to dig deeper into the ███.mil scope/IP space and found other instances of vulnerable Oracle WebLogic. I decided t...