CVE-2017-11563

D-Link EyeOn Baby Monitor DCS-825L 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd t...

CVE-2017-11563

The CVE-2017-11563 vulnerability affects the D-Link EyeOn Baby Monitor (DCS-825L) with firmware 1.08.1. A UDP Discover service on the device runs a finder process; a crafted UDP request can trigger a stack overflow, allowing remote code execution with root privileges. The vulnerability is network...

CVE-2017-11563

D-Link EyeOn Baby Monitor DCS-825L 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd t...

Central Management Software 1.4.13 - Denial of Service (PoC)

Exploit Title: Central Management Software v1.4.13 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link:...

discover-by-search.info XSS vulnerability

Open Bug Bounty ID: OBB-636186 Description| Value ---|--- Affected Website:| discover-by-search.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-12436

wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physic...

CVE-2018-4244

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri Contacts" component. It allows physically proximate attackers to discover private contact information via Siri...

Code injection

mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010...

Cross site scripting

Cross-site scripting XSS vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover - Audit Scripts - List Scripts - Download section...

CVE-2018-10314

Open-AudIT Community 2.2.0 contains a documented Cross-Site Scripting (XSS) vulnerability. An attacker can inject arbitrary web script or HTML by supplying a crafted name for a component, exploited via the action parameter in Discover → Audit Scripts → List Scripts → Download. The description con...

CVE-2018-10314

Cross-site scripting XSS vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover - Audit Scripts - List Scripts - Download section...

xdebug Unauthenticated OS Command Execution Exploit

This Metasploit module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below. This allows the attacker to execute arbitrary php code as the context of the web user. This module requires Metasploit: https://metasploit.com/download Current source:...

Command injection

The FromDocToPDF extension before 13.611.13.2303 for Chrome allows remote attackers to discover visited web sites via vectors involving a mostVisitedSites command...

CVE-2018-10178

The CVE-2018-10178 entry refers to the FromDocToPDF extension for Chrome, impacted versions prior to 13.611.13.2303. The vulnerability allows remote attackers to disclose the websites the user has visited through vectors involving a mostVisitedSites command, constituting an information-disclosure...

Code injection

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves alarm and timer handling in the "Clock" component. It allows physically proximate attackers to discover the iTunes e-mail address...

discover-syria.com XSS vulnerability

Open Bug Bounty ID: OBB-571020 Description| Value ---|--- Affected Website:| discover-syria.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fr.discoverboating.ca Open Redirect vulnerability

Open Bug Bounty ID: OBB-562096 Description| Value ---|--- Affected Website:| fr.discoverboating.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

CVE-2018-6790

An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element...

CVE-2018-5693

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog...

CVE-2017-8440

Starting in version 5.3.0, Kibana had a cross-site scripting XSS vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...