CVE-2019-3911

Reflected cross-site scripting XSS vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /r2/query endpoints...

Open redirect

An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /r1/ returnURL parameter allows an unauthenticated remote attacker to redirect users to arbitrary web sites...

CVE-2019-3912

CVE-2019-3912 affects LabKey Server Community Edition prior to 18.3.0-61806.763. The Open Redirect vulnerability is triggered via the /__r1/ returnURL parameter, allowing an unauthenticated remote attacker to redirect users to arbitrary external sites. The NUCLEI template and NVD entry confirm th...

CB Customer Spotlight: Q&A with Ritter Insurance Marketing’s Dan McLellan

Dan McLellan is a Network Support Specialist at Ritter Insurance Marketing, and uses the Carbon Black community to increase his security knowledge and share information with his colleagues. Having access to insights from other security professionals has not only shortened the time he spends tryin...

PT-2019-16767 · Labkey · Labkey Server Community Edition

Name of the Vulnerable Software and Affected Versions: LabKey Server Community Edition versions prior to 18.3.0-61806.763 Description: The issue is related to an open redirect vulnerability. It affects the / r1/ API endpoint, specifically the returnURL parameter, allowing an unauthenticated remot...

Rockstar Games: CSRF Vulnerability on post creation page /community/create-post.json

In this report the researcher demonstrated how to exploit a CSRF vulnerability on the impacted endpoint. This would allow a remote attacker to spam the community boards as other users. This attack only worked in Chrome browsers. A recent update to Chrome changed how cross-origin requests are...

Nessus 8.2.1 Cross Site Scripting

Exploit Title: Nessus 8.2.1 | Stored Cross-Site Scripting Date: 29.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.tenable.com Software Link: https://www.tenable.com/downloads/nessus Version: 8.2.1 Introduction Nessus is 1 For Vulnerability Assessment From the beginning, we've...

Rundeck Community Edition Cross Site Scripting

Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prin...

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting

Rundeck Community Edition 3.0.13 - Persistent Cross-Site Scripting Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Rundeck Community Edition before 3.0.13 Multiple Stored XSS Vendor Homepage: https://www.rundeck.com/open-source Software Link: https://docs.rundeck.com/downloads.html Exploit Author: Ishaq Mohammed Contact:...

Cross site scripting

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp...

CVE-2019-6804

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp...

CVE-2019-6804

CVE-2019-6804 is an XSS vulnerability in Rundeck Community Edition prior to 3.0.13, affecting the Job Edit workflow module. The issue stems from how inputs in Arguments, Invocation String, and File Extension fields are rendered in the Execution Preview, with references to assets/javascripts/workf...

WordPress MM-Forms-Community 2.2.7 Shell Upload / SQL Injection

Exploit Title : WordPress MM-Forms-Community Plugins 2.2.7 Shell Upload and SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 26/01/2019 Vendor Homepage : wordpress.org Software Download Link : downloads.wordpress.org/plugin/mm-forms-community.zip...

SNMP Login Successful For Authenticated Checks

It was possible to login using the provided SNMPv1 / SNMPv2 community string / SNMPv3 credentials. Hence version checks based on SNMP are working. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

SNMP Login Failed For Authenticated Checks

It was NOT possible to login using the provided SNMPv1 / SNMPv2 community string / SNMPv3 credentials. Hence version checks based on SNMP might not work if no other default community string was found. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a...

Endian Firewall Community release 3.3.0 Cross Site Scripting

Exploit Title: Endian Firewall Community release 3.3.0 | Cross-Site Scripting Date: 24.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.endian.com Software Link: https://sourceforge.net/projects/efw/files/Development/EFW-3.3.0/ Version: 3.3.0 Introduction Endian Firewall Community...

'Chaos' iPhone X Attack Alleges Remote Jailbreak

A Chinese security researcher has published what he claims is a proof-of-concept exploit that would allow a remote attacker to jailbreak an iPhoneX, unbeknownst to the user – allowing them to gain access to a victim’s data, processing power and more. Qixun Zhao of Qihoo 360 built the exploit, whi...

Echo Mirage 3.1 - Buffer Overflow (PoC)

Echo Mirage 3.1 - Buffer Overflow PoC !/usr/bin/python Exploit Title: Echo Mirage 3.1 Buffer Overflow PoC Stack Overflow Date: 21-01-2019 Software Link: https://sourceforge.net/projects/echomirage.oldbutgold.p/ Version: 3.1 x64 Exploit Author: InitD Community Contact: https://twitter.com/initdsh...

Echo Mirage 3.1 - Buffer Overflow Exploit

!/usr/bin/python Exploit Title: Echo Mirage 3.1 Buffer Overflow PoC Stack Overflow Software Link: https://sourceforge.net/projects/echomirage.oldbutgold.p/ Version: 3.1 x64 Exploit Author: InitD Community Contact: https://twitter.com/initdsh Website: http://initd.sh/ Tested on: Windows 7 """ Step...