HackerOne: Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request

Summary: by sending a crafted request on ctf.hacker101.com a very long delay with a response of error 502 has been observed I suspect that if I made this request on multiple tabs on my browser concurrently, it may cause ctf.hacker101.com to crash thats why I haven't tried it. Description: By...

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially create...

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially...

Cisco Unified Communications Manager Path Traversal (cisco-sa-cucm-taps-path-trav-pfsFO93r)

According to its self-reported version, Cisco Unified Communications Manager is affected by a path traversal vulnerability in the Tool for Auto-Registered Phones Support TAPS due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An unauthenticated,...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2020-24057)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Broadcom CA API Developer Portal Elevation of Privilege Vulnerability

Broadcom CA API Developer Portal is an API developer portal product of Broadcom's complete API lifecycle management solution, which provides API release control, API performance monitoring and other functions. A security vulnerability exists in Broadcom CA API Developer Portal 4.3.1 and prior...

Microsoft SharePoint Spoofing Vulnerability (CNVD-2020-23442)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A security...

Unspecified Vulnerability in Microsoft SharePoint

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A security...

Intel Modular Server MFS2600KISPP Compute Module elevation of privilege vulnerability (CNVD-2020-28230)

Intel Modular Server MFS2600KISPP Compute Module is a computing module from Intel Corporation USA. A security vulnerability exists in Intel Modular Server MFS2600KISPP Compute Module, which stems from a failure of proper access control. The vulnerability can be exploited by an attacker to elevate...

CVE-2020-3177 Cisco Unified Communications Manager Path Traversal Vulnerability

A vulnerability in the Tool for Auto-Registered Phones Support TAPS of Cisco Unified Communications Manager UCM and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The...

Code injection

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted request specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-ForceID:...

Information disclosure

Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EMC PowerEdge VRTX Switch Modules firmware versions 2.0.0.77 and older contain an information disclosure vulnerability. A remote unauthenticated attacker coul...

Denial Of Service (DoS)

krb5 is vulnerable to denial of service DoS. The vulnerability exists through the way MIT Kerberos KDC processed certain principal names when the KDC was configured to use an LDAP back end. A remote attacker could use this flaw to cause the KDC to hang via a specially-crafted request...

Denial Of Service (DoS)

Python is vulnerable to denial of serviceDoS. Due to a flaw found in the way the Python CGIHTTPServer module processed certain HTTP GET requests, a remote attacker could use a specially-crafted request to obtain the CGI script's source code...

Directory Traversal

MySQL is vulnerable to directory traversal. Due to the way MySQL handled the parameters of the MySQL COMFIELDLIST network protocol command, an authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially-crafted table...

Denial Of Service (DoS)

The kernel is vulnerable to Denial Of Service DoS. An array index error was found in the gdth driver. A local user could send a specially-crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation...

Denial Of Service (DoS)

httpd is vulnerable to denial of service. A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a...

Argo Authorization Issues Vulnerability

Argo is an open source container native workflow engine. Argo suffers from an authorization issue vulnerability that stems from the program setting the default administrator password to the argocd-server container group name. An attacker can exploit this vulnerability to gain administrator...

Samsung Mobile Device Digital Error Vulnerability

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a numeric error vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a...

Samsung Mobile Device Input Validation Error Vulnerability (CNVD-2020-30780)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from an input validation error vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the hel...