Forensic File System Reconstruction: RecuperaBit

Forensic File System Reconstruction A software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of: missing partition table unknown partition boundaries...

Ian Dunn: CSV Injection in Camptix

Hello, Ian! I see you tried to escape "=, -, +, @" in your code 151516, but let me show simple workaround. I've made CSV injection by using this string ";=cmd|' /C calc'!A5" without doublequotes. ";" will bypass your trying to set the quote in the beginning of the string. ";" acts as a new cell...

WordPress Plugin Mail Masta 1.0 - Local File Inclusion

WordPress Plugin Mail Masta 1.0 - Local File Inclusion + Date: 23-8-2016 + Autor Guillermo Garcia Marcos + Vendor: https://downloads.wordpress.org/plugin/mail-masta.zip + Title: Mail Masta WP Local File Inclusion + info: Local File Inclusion The File Inclusion vulnerability allows an attacker to...

Ian Dunn: bypass to csv injection

Hi Ian, I would like to add payload to this report 151516. payload used: http://google.com?,=2+2-2+3+cmd|' /C calc'!G2 When injecting https://google.com? it will be rendered as a link but when comma , it will be rendered in a new cell which will execute the command. Thanks,...

Ian Dunn: Bypassing CSV injection using new line charcter

whitewalker reported that esccsv could be bypassed by using %0A-3+3+cmd|' /C calc'!D2 as the payload. For example, the firstname parameter in the following request: curl -ik 'https://2016.misc.wordcamp.dev/tickets/?tixaction=checkouttix' -H 'Host: 2016.misc.wordcamp.dev' -H 'User-Agent: Mozilla/5...

Internet Bug Bounty: integer overflow in the _csv module's join_append_data function

I described this vulnerability in detail in a mail to the PSRT. A copy of my email, plus the fix for this issue, can be found here: https://bugs.python.org/issue27758...

CampTix Event Ticketing <= 1.4.2 - CSV Injection and XSS

The CampTix Event Ticketing WordPress plugin was affected by a CSV Injection and XSS security vulnerability...

DEBIAN-CVE-2016-5000

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

UBUNTU-CVE-2016-5000

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Windows Mapped Network Drives

Nessus was able to generate a report of mapped network drives on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92422; scriptversion"1.6"; scriptcvsdate"Date: 2018/11/15 20:50:27"; scriptnameenglish:"Windows Mapped Network Drives";...

Explorer Search History

Nessus was able to gather evidence of cached search results from Windows Explorer searches. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92439; scriptversion"1.6"; scriptcvsdate"Date: 2018/11/15 20:50:27"; scriptnameenglish:"Explorer Search History";...

Internet Explorer Typed URLs

Nessus was able to generate a list URLs that were manually typed into the Internet Explorer address bar. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description scriptid92421; scriptversion"1.6";...

Microsoft Windows Scripting Host Settings

Nessus was able to collect system and user level Windows scripting host settings from the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92368; scriptversion"1.5"; scriptcvsdate"Date: 2018/05/23 16:10:01"...

Microsoft Office Macros Configuration

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description...

Microsoft Windows Environment Variables

Nessus was able to collect system and active account environment variables on the remote Windows host and generate a report as a CSV attachment. C Tenable, Inc. include"compat.inc"; if description scriptid92364; scriptversion"1.15"; scriptsetattributeattribute:"pluginmodificationdate",...

Ian Dunn: CSV Injection at Camptix Event Ticketing

Hi, As you mentioned the scope of vulnerability as Any plugin listed on my WordPress.org profile. I am reporting this issue. I have seen from your WordPress.org profile the second plugin listed is Camptix Event Ticketing So I looked at the source code of the plugin...

HPE LoadRunner Virtual Table Server import_csv Remote File Deletion DoS

The Hewlett Packard Enterprise HPE LoadRunner Virtual Table Server application running on the remote host is affected by a flaw in the importcsv feature due to a failure to restrict file paths sent to an unlink call. An unauthenticated, remote attacker can exploit this to delete arbitrary files o...

[SECURITY] Fedora 22 Update: phpMyAdmin-4.6.3-1.fc22

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

Pornhub: RCE Possible Via Video Manager Export using @ character in Video Title

The researcher identified that it was possible to inject arbitrary characters into video titles, that when exported via video manager would result in client-side code execution. The researcher was successful in getting a pingback from a meterpreter shell on the victim's machine. Essentially using...

[SECURITY] Fedora 24 Update: phpMyAdmin-4.6.2-1.fc24

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...