Slack: Bypass to postMessage origin validation via FTP

@a1kmm- discovered a bypass to our postMessage origin check, wherein an attacker with existing MITM capabilities could use FTP to bypass validation and view XOXS tokens of victims on the local network. This was related to, and investigated at the same time as, a previous report. This issue is now...

BlueIris 4.5.1.4 - Denial of Service Exploit

Exploit for windows platform in category dos / poc import socket Title: BlueIris - Denial of Service Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://blueirissoftware.com/blueiris.exe Version: 4.5.1.4 Tested on: Windows Server 2008 ...

BlueIris 4.5.1.4 Denial Of Service

import socket Title: BlueIris - Denial of Service Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://blueirissoftware.com/blueiris.exe Version: 4.5.1.4 Tested on: Windows Server 2008 R2 Standard x64 Start this fake FTP server and crea...

Java Applet FTP Protocol Stream Injection

A FTP protocol stream injection vulnerability has been reported in Java's Applets. The vulnerability is due to improper URL handling code. A remote attacker may exploit this issue using a specially crafted Java applet which can enable an attacker to run FTP commands on the effected system...

Multiple vulnerabilities in Accellion FTP server

Accellion FTP server is a file transfer server from Accellion, USA. An information disclosure and cross-site scripting vulnerability exists in Accellion FTP server, which can be exploited by an attacker to execute arbitrary script code in the context of a browser to steal cookie-based...

BlueIris 4.5.1.4 - Denial of Service

BlueIris 4.5.1.4 - Denial of Service import socket Title: BlueIris - Denial of Service Date: 2017-02-28 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: http://blueirissoftware.com/blueiris.exe Version: 4.5.1.4 Tested on: Windows Server 2008 R2 Standard x6...

MGASA-2017-0067 Updated php-tcpdf packages fix security vulnerability

A local file inclusion vulnerability in TCPDF allows to upload files from the server generating PDF files to an external FTP server CVE-2017-6100. The updated php-tcpdf-6.0.098-1.1.mga5 package fixes this issue by setting KTCPDFCALLSINHTML configuration parameter to false by default...

Updated php-tcpdf packages fix security vulnerability

A local file inclusion vulnerability in TCPDF allows to upload files from the server generating PDF files to an external FTP server CVE-2017-6100. The updated php-tcpdf-6.0.098-1.1.mga5 package fixes this issue by setting KTCPDFCALLSINHTML configuration parameter to false by default...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

Code injection

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

DEBIAN-CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

CVE-2017-6100

CVE-2017-6100 affects TCPDF prior to 6.2.0. The vulnerability is a local file inclusion flaw that enables the server to upload PDF-generated files to an external FTP server. Reported behavior across sources consistently notes that versions before 6.2.0 are impacted; a fix is to upgrade to 6.2.0 o...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

Java, Python FTP Injection Attacks Bypass Firewalls

Newly disclosed FTP injection vulnerabilities in Java and Python that are fueled by rather common XML External Entity XXE flaws carry the potential to expose sensitive systems to attack. Details about both issues were publicly disclosed this week, but private notifications were made to the Python...

Unpatched Python and Java Flaws Let Hackers Bypass Firewall Using FTP Injection

This newly discovered bugs in Java and Python is a big deal today. The two popular programming languages, Java and Python, contain similar security flaws that can be exploited to send unauthorized emails and bypass any firewall defenses. And since both the flaws remain unpatched, hackers can take...

Freefloat FTP Server 1.0 - 'SITE ZONE' Command Buffer Overflow

Vulnerability background An ftp server seems to be very small,the feeling should be not many people use this to open the ftp service, but there is a vulnerability, and zoomeye be able to search to a lot of equipment to use the service,and the analysis very simple. Vulnerability details Treatment...

Accellion FTP server contains information exposure and cross-site scripting vulnerabilities

Overview The Accellion FTP server prior to version FTA912220 is vulnerable to cross-site scripting and information exposure. Description CWE-204: Response Discrepancy Information Exposure- CVE-2016-9499Accellion FTP server only returns the username in the server response if the a username is...