Important Announcement

ATTENTION: Your vulnerability tests are out of maintenance and not updated since July 1st 2020. Your setup of Greenbone Source Edition will not report about any new threats in your scanned environment since this date! REASON: Your Greenbone setup is connected to a discontinued download protocol o...

CVE-2016-6366

creationtimestamp| type| source ---|---|--- 2020-07-16 15:38:10+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/ciscoasaextrabacon.rb 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-04 11:39:27+00:00|...

FreeBSD : mybb -- multible vulnerabilities (198a120d-c22d-11ea-9172-4c72b94353b5)

mybb Team reports : High risk: Installer RCE on settings file write Medium risk: Arbitrary upload paths and Local File Inclusion RCE Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data Low risk: Open redirect on login Low risk: SCEditor reflected XSS C Tenable Network...

CVE-2018-19953

creationtimestamp| type| source ---|---|--- 2020-06-08 08:30:02+00:00| exploited| https://t.me/SecLabNews/7783 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 20:58:35+00:00| seen| https://t.me/arpsyndicate/1027 2024-12-24 20:31:30+00:00| seen|...

CVE-2018-19949

creationtimestamp| type| source ---|---|--- 2020-06-08 08:30:02+00:00| exploited| https://t.me/SecLabNews/7783 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-04 22:56:56+00:00| seen| https://t.me/arpsyndicate/1326 2024-12-24 20:31:29+00:00| seen|...

Naviwebs Navigate CMS Cross-Site Scripting Vulnerability

Navigate CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in the lib/packages/feeds/feed.class.php file in Navigate CMS 2.8.7 and earlier versions. The vulnerability stems from the WEB application lacking proper validation of client-side data. An...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...

PT-2020-6928

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.18.0 Description The issue is related to the httplib2 library's failure to neutralize CRLF sequences, allowing a remote attacker to impact data integrity. In httplib2 before version 0.18.0, an attacker controlling ...

Open-sourcing new COVID-19 threat intelligence

A global threat requires a global response. While the world faces the common threat of COVID-19, defenders are working overtime to protect users all over the globe from cybercriminals using COVID-19 as a lure to mount attacks. As a security intelligence community, we are stronger when we share...

Create-Project Manager 1.07 Cross Site Scripting / HTML Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?srank=3 Version: 1.6 Tested on:...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security testing and penetration testing purposes. The primary vulnerability class targeted by this repository is CRLF Carriage Return an...

CVE-2020-4428

creationtimestamp| type| source ---|---|--- 2020-05-05 17:17:40+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ibmdrmrce.rb 2021-11-08 08:58:18+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen|...

[20210304] - Core - XSS within the feed parser library

Missing filtering of feed fields could lead to xss issues...

haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...

PT-2020-9208 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.3-8017-2 Description: The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and application crash, via crafted network traffic. This is due to a CR...

python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

MITRE ATT&CK Evaluation Demonstrates the Power of the VMware Carbon Black Cloud

MITRE has released the results for its latest endpoint detection and response EDR product evaluation using its now industry-standard open methodology, the ATT&CK® framework. This year’s results further demonstrate why VMware Carbon Black, now a two-time participant, is a top choice of security an...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

CVE-2020-1027

creationtimestamp| type| source ---|---|--- 2020-04-15 12:22:54+00:00| seen| https://t.me/truesecator/475 2020-04-17 11:03:51+00:00| seen| https://t.me/DerechodelaRed/2746 2022-06-07 18:51:40+00:00| exploited| https://t.me/CyberSecurityTechnologies/2486 2023-06-14 21:10:04+00:00| seen|...