CVE-2018-15182

CVE-2018-15182 affects PHP Scripts Mall Car Rental Script 2.0.8, with Cross‑Site Scripting via the FirstName and LastName fields. The connected documents corroborate an HTML/JS injection vulnerability in this script, but the provided materials do not specify the exact root cause, affected code lo...

CVE-2018-15182

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields...

CVE-2018-15182: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields...

PT-2018-12929

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Car Rental Script version 2.0.8 Description The issue allows for XSS via the FirstName and LastName fields. Recommendations For PHP Scripts Mall Car Rental Script version 2.0.8, consider validating and sanitizing user input fo...

Podcast: enSilo CEO on Black Hat USA 2018 Trends

Las Vegas – Threatpost’s Lindsey O’Donnell sits down with enSilo CEO Roy Katmor to talk about the top trends that we are seeing this week at Black Hat USA 2018 – from machine learning to connected-car security. Download here:...

A study of car sharing apps

The growing popularity of car sharing services has led some experts to predict an end to private car ownership in big cities. The statistics appear to back up this claim: for example, in 2017 Moscow saw the car sharing fleet, the number of active users and the number of trips they made almost...

carmagazine.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-642947 Description| Value ---|--- Affected Website:| carmagazine.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bilpriser.dk XSS vulnerability

Open Bug Bounty ID: OBB-640125 Description| Value ---|--- Affected Website:| bilpriser.dk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

volvooflisle.financing.dealer.com XSS vulnerability

Open Bug Bounty ID: OBB-632376 Description| Value ---|--- Affected Website:| volvooflisle.financing.dealer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

mazdacarinsurance-dealer.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-631614 Description| Value ---|--- Affected Website:| mazdacarinsurance-dealer.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-9313

The Head Unit HUNBT aka Infotainment component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a remote attack via Bluetooth when in pairing mode, leading to a Head Unit reboot...

Design/Logic Flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car different for every vendor / car product line / car. No...

Design/Logic Flaw

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

CVE-2018-11477

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

CVE-2018-11477

CVE-2018-11477 affects Vgate iCar 2 Wi‑Fi OBD2 Dongle. The issue is that data packets between the mobile apps (iOS/Android) and the dongle are not encrypted, and there is a lack of wireless network protection. This potentially allows an attacker on the same network to access transferred car data....

CVE-2018-11477

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

Chinese Hackers Find Over a Dozen Vulnerabilities in BMW Cars

Chinese security researchers have discovered more than a dozen vulnerabilities in the onboard compute units of BMW cars, some of which can be exploited remotely to compromise a vehicle. The security flaws have been discovered during a year-long security audit conducted by researchers from Keen...

Auto Car 1.2 - car_title SQL Injection / Cross-Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Auto car 1.2 - 'cartitle' SQL Injection / Cross-Site Scripting Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/auto-car-car-listing-script/19221368?srank=1159 Version: 1.2 Tested on: Win 10 POC...

Auto Car 1.2 - car_title SQL Injection Cross-Site Scripting

Auto Car 1.2 - cartitle SQL Injection Cross-Site Scripting Exploit Title: Auto car 1.2 - 'cartitle' SQL Injection / Cross-Site Scripting Date: 2018-05-22 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/auto-car-car-listing-script/19221368?srank=1159 Version: 1.2...

Auto Car 1.2 - 'car_title' SQL Injection / Cross-Site Scripting

Exploit Title: Auto car 1.2 - 'cartitle' SQL Injection / Cross-Site Scripting Date: 2018-05-22 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/auto-car-car-listing-script/19221368?srank=1159 Version: 1.2 Tested on: Win 10 POC 1: SQLi: Parameter: cartitle Type:...