CVE-2018-5109

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This...

CVE-2018-5109

An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This...

CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

CloudBees Jenkins GitHub Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . GitHub Plugin is used in one of the...

CVE-2018-1000183

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

CVE-2018-1000186

A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another...

CVE-2018-1000183

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

CSS Keylogger - Chrome Extension And Express Server That Exploits Keylogging Abilities Of CSS

Chrome extension and Express server that exploits keylogging abilities of CSS. To use SetupChrome extension 1. Download repository git clone https://github.com/maxchehab/CSS-Keylogging 2. Visit chrome://extensions in your browser or open up the Chrome menu by clicking the icon to the far right of...

CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials

Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored...

CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials

GitHub Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

Kangaroo Life App has a Bursting Vulnerability

Kangaroo Life App is a mobile lending software. Kangaroo Life APP has a blasting vulnerability. Attackers can log in to any account by grabbing packets and blasting CAPTCHA...

Arbitrary User Registration Vulnerability in Small Objects App

Small Object APP is a dating software based on mobile internet and big data matching. There is an arbitrary user registration vulnerability in Small Object APP. Attackers can register any account by grabbing packets and blasting the verification code...

Security update for wireshark (moderate)

This update for wireshark fixes the following issues: Minor vulnerabilities that could be used to trigger dissector crashes or cause excessive memory use by making Wireshark read specially crafted packages from the network or capture files boo1094301: - CVE-2018-11356: DNS dissector crash -...

Airpydump - Analyze Wireless Packets On The Fly. Currently Supporting Three Working Modes (Reader, Live, Stealth)

Analyze Wireless Packets on the fly. Currently supporting three working Modes Reader, Live, Stealth Description airpydump is a wireless packet analyzer, providing the interface most likely that of airodump-ng from aircrack suite. It currently provides three working modes which are Reader, Stealth...

Peanut Metro WIFI APP has logic design flaws

Peanut Metro WIFI APP is a free wifi software for metro launched by Peanut Technology. There is a logical design vulnerability in Peanut Metro WIFI APP. Attackers can reset any password by forgetting the password function and utilizing packet capture and blasting to obtain the verification code...

CVE-2018-8860

The CVE affects Vecna VGo Robot—versions 3.0.3.52164 and 3.0.3.53662 (earlier versions may also be affected). The flaw enables an attacker on an adjacent network to capture firmware updates, exposing sensitive information and potentially enabling further compromise. The NVD/ICSA data record a CVS...

Override Access Vulnerability in the Swish Open App

Swish and Drive App is a rental car for traveling. A vulnerability exists in Swish and Drive APP. An attacker can gain access to sensitive information by grabbing packets and modifying IDs...

Wutong Cat Mall mobile app has logic design flaws

Sycamore Cat Mall Mobile App is an online shopping mall software. There is a logic design vulnerability in Wutong Cat Mall Mobile APP. Attackers can register any account by grabbing packets to get the verification code...

LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator

Generates a Malicious ODT File which can be used with auxiliary/server/capture/smb or similar to capture hashes. Module Options msf use auxiliary/fileformat/odt/badodt msf undefinedbadodt show actions ...actions... msf undefinedbadodt set ACTION msf undefinedbadodt show options ...show and set...

Logic flaw vulnerability in the practical internship management support platform developed under the Higher Education Publishing House umbrella

The Higher Education Publishing House Practice Internship Management Support Platform is a system that provides practice internship management. A logic flaw vulnerability exists in the Practice Internship Management Support Platform developed under the Higher Education Publishing House. An attack...