CVE-2018-1153

Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic...

Input validation

PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data...

CVE-2018-10377

PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data...

CVE-2018-10377

PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data...

CVE-2018-10377

Summary: Burp Suite before 1.7.34 contains an improper validation of the Collaborator server certificate, enabling a MITM attacker to obtain interaction data. This is reflected across multiple sources (NVD entry CVE-2018-10377 and OpenVAS notes). Affected? Burp Suite (Community/Standard) prior to...

CVE-2018-10377

PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data...

PortSwigger Web Security: Activat burp suite pro with the old license after transfared to anothe account

Hi team. I made 2 accounts and purchased burpsuite pro. The first account with this email :- ███████ The second account with this email :- ██████ I have opened a support ticket on Jun 13, 2018 05:26PM and the message is :- Hi Could you please add this account to my existing account ████ ███████ t...

GLSA-201806-03 : BURP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201806-03 BURP: Multiple vulnerabilities It was discovered that Gentoos BURP ebuild does not properly set permissions or place the pid file in a safe directory. Impact : A local attacker could escalate privileges. Workaround : Use...

BURP: Multiple vulnerabilities

Background A network backup and restore program. Description It was discovered that Gentoo’s BURP ebuild does not properly set permissions or place the pid file in a safe directory. Impact A local attacker could escalate privileges. Workaround Users should ensure the proper permissions are set as...

Pro Tips: Testing Applications Using Burp, and More

Burp Suite is one of my favorite tools for web application testing. The feature set is rich, and anything that it does not do by default can usually be added with an extension. There are a few things, however, that while they exist in Burp Suite, are not completely intuitive. Below are a few pro...

SleuthQL - Burp History Parsing Tool To Discover Potential SQL Injection Points

SleuthQL is a python3 script to identify parameters and values that contain SQL-like syntax. Once identified, SleuthQL will then insert SQLMap identifiers into each parameter where the SQL-esque variables were identified. Supported Request Types SleuthQL requires an export of Burp's Proxy History...

Gentoo app-backup/burp package arbitrary file access read vulnerability

The Gentoo app-backup/burp package is a network backup and recovery program from the Gentoo Foundation. A security vulnerability exists in the Gentoo app-backup/burp package prior to version 2.1.32. A local attacker can exploit this vulnerability by modifying the burp-server.conf file to gain...

Gentoo app-backup/burp package design vulnerability

The Gentoo app-backup/burp package is a network backup and recovery program from the Gentoo Foundation. A security vulnerability in the Gentoo app-backup/burp package prior to version 2.1.32 stems from the program setting ownership of the PID file directory to the burp account. A local attacker...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

Arbitrary file deletion

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18285

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

Design/Logic Flaw

The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...