781 matches found
F5 Networks BIG-IP : libxml2 vulnerability (K14338030)
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document. CVE-2016-1762 File data f5bigipSOL14338030.nasl...
Microsoft Internet Explorer 9 - MSHTML CDispNode::InsertSiblingNode Use-After-Free (MS13-037) (2)
!-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability. Known...
Microsoft Internet Explorer 9 - MSHTML CElement::HasFlag Memory Corruption
// First tag can be any inline but must NOT be closed yet // Second tag can be anything that's not inline. // "text1" can be anything document.write'text1'; // The tree is in good shape. show"DOM Tree after first write", getElementTreedocument.body; // At this point, it appears that MSIE is sti...
Microsoft Internet Explorer 11 iertutil LCIEGetTypedComponentFromThread Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the thirteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throu...
OLX: Reflected XSS at m.olx.ph
INTRO The m.olx.ph domain is vulnerable to reflected XSS through the search function. EXPLOITABILITY & PoC The following URL contains an XSS vector, which causes an alert box to appear https://m.olx.ph/all-results?q=:%27%3E%3Cimg%20src=/%20onerror=alert%28document.domain%29%3E or...
Legal Robot: 2 vulns
the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...
Vanderbilt Industries Siemens IP CCTV Cameras Vulnerability
OVERVIEW Siemens reports that there is a vulnerability in Siemens-branded IP cameras from Vanderbilt Industries. Vanderbilt has released updates to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the vulnerability affects the...
HackerOne: Non-secure requests are not automatically upgraded to HTTPS
Non-secure requests to hackerone.com e.g. http://hackerone.com are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because hackerone.com is HSTS preloaded. When a domain is...
Veris: Internal server error 500 at log.veris.in
INTRO: i have discovered an internal server error 500 at log.veris.in in sentry app & possible DoS injection with data garbage EXPLOITABILITY: Steps: 1After Sending this request Sentry is crash with an internal server error showing version of sentry and the capability of sending the issue with a...
Siemens SIMATIC STEP 7 (TIA Portal) Information Disclosure Vulnerabilities
OVERVIEW Siemens has released a new version of SIMATIC STEP 7 TIA Portal to mitigate information disclosure vulnerabilities. These vulnerabilities were reported directly to Siemens by Dmitry Sklyarov and Gleb Gritsai from Positive Technologies. Siemens has produced a new version to mitigate these...
lisa.py - An Exploit Dev Swiss Army Knife
lisa.py An Exploit Dev Swiss Army Knife. Installation Copy lisa.py and .lldbinit to / Use the following commands: ant4g0nist$ cp lisa.py /lisa.py ant4g0nist$ cp lldbinit /.lldbinit ant4g0nist$ lldb lllllll iiii l:::::l i::::i l:::::l iiii l:::::l l::::l iiiiiii ssssssssss aaaaaaaaaaaaa l::::l...
PHP serialize/object injection vulnerability exploit-vulnerability warning-the black bar safety net
! This article is about PHP serialize/object injection vulnerability analysis of the short story, which tells about how to get the host of the remote shell. If you want to learn more about PHP serialized content, please visit this link. If you want to test this vulnerability, you can by XVWA and...
WECON LeviStudio Buffer Overflow Vulnerabilities
OVERVIEW Independent security researchers Rocco Calvi and Brian Gorenc, working with Trend Micro’s Zero Day Initiative, have identified buffer overflow vulnerabilities in WECON’s LeviStudio software. WECON has not released a product fix to addresses the buffer overflow vulnerabilities in the...
Rockwell Automation Allen-Bradley Stratix 5400 and 5410 Packet Corruption Vulnerability
OVERVIEW Rockwell Automation has identified a resource management vulnerability in Rockwell Automation’s Allen-Bradley Stratix 5400 and Allen-Bradley Stratix 5410 industrial networking switches. Rockwell Automation has produced a new firmware version to mitigate this vulnerability. This...
MS16-015: Security Update for Microsoft Office to Address Remote Code Execution (3134226) (Mac OS X)
The version of Microsoft Office installed on the remote Mac OS X host is affected by multiple remote code execution vulnerabilities due to improper handling of objects in memory. A remote attacker can exploit these vulnerabilities by convincing a user to open a specially crafted file in Microsoft...
Triaging the exploitability of IE/EDGE crashes
Introduction Both Internet Explorer IE and Edge have seen significant changes in order to help protect customers from security threats. This work has featured a number of mitigations that together have not only rendered classes of vulnerabilities not-exploitable, but also dramatically raised the...
Server: Reflected XSS in OCS provider discovery
A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Servers allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting. Since ownCloud employs a strict Content-Security-Policy that forbids inline script...
F5 Networks BIG-IP : QEMU vulnerability (SOL51841514)
hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WINREADNATIVEMAX command to an empty drive, which triggers a...
Oracle Linux 6 : libpng (ELSA-2015-2594)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2594 advisory. - Security fix for CVE-2015-7981 and CVE-2015-8126 Tenable has extracted the preceding description block directly from the Oracle Linux security...
Dimofinf 3.0.0 SQL Injection
Dimofinf CMS Automatic Cookie SQL Injection exploit Google Dork: intext:"Powered by Dimofinf" Date: 19/11/2015 Author: D35m0nd142 Software link: http://www.dimofinf.net Version: 3.0.0 Tested on: Dimofinf version 3.0.0 Sometimes it happens that the vulnerability allow you to get moderators' userna...