Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload

Microsoft Lync for Mac 2011 - Injection Forced BrowsingDownload Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517...

Facebook - Instagram Business Access Token Vulnerability

Document Title: =============== Facebook - Instagram Business Access Token Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2152 URL: https://www.youtube.com/watch?v=tdLKRky1Da4 News & Press:...

Facebook - Instagram Business Access Token Demo PoC

Document Title: =============== Facebook - Instagram Business Access Token Demo PoC References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2153 View: https://www.youtube.com/watch?v=4Obsd1Qw7uU News & Press:...

Beware! Unpatched Safari Browser Hack Lets Attackers Spoof URLs

A security researcher has discovered a serious vulnerability that could allow attackers to spoof website addresses in the Microsoft Edge web browser for Windows and Apple Safari for iOS. While Microsoft fixed the address bar URL spoofing vulnerability last month as part of its monthly security...

PLANEX CS-W50HD Hardcoded Credentials Vulnerability (HTTP)

PLANEX CS-W50HD network camera are using hardcoded credentials for the HTTP login. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

R v3.4.4 Software - (SEH) Buffer Overflow Vulnerability

Document Title: =============== R v3.4.4 Software - SEH Buffer Overflow Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2143 Release Date: ============= 2018-08-26 Vulnerability Laboratory ID VL-ID: ==================================== 214...

BMW - (Token) Cross Site Scripting Web Vulnerability

Document Title: =============== BMW - Token Cross Site Scripting Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1914 Video: https://www.youtube.com/watch?v=txjW7fpMJ-Q Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability...

OpenConext-EngineBlock 5.7.3 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 XSS vulnerabilities were found in multiple pages that allows an attacker to inject arbitrary web scripts. The Twig PHP extension configuration was not sanitizing user input before display it to the user. Issues fixed in version 5.7.4 and 5.8.0. Git...

OpenConext-EngineBlock 5.7.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications XSS vulnerabilities were found in multiple pages that allows an attacker to inject arbitrary web scripts. The Twig PHP extension configuration was not sanitizing user input before display it to the user. Issues fixed in version 5.7.4 and 5.8.0...

Openfire < 3.9.2 Reflected XSS Vulnerability - Active Check

Openfire is prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection

WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection Title: WordPress Plugin Pie Register order = escsql $order ; IV. PROOF OF CONCEPT The following URL have been confirmed to all suffer from Time Based SQL Injection. GET...

WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection

Title: WordPress Plugin Pie Register order = escsql $order ; IV. PROOF OF CONCEPT The following URL have been confirmed to all suffer from Time Based SQL Injection. GET /wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc original GET...

D-Link DSL-3782 - Authentication Bypass

Exploit Title: D-Link DSL 3782 - Authentication Bypass Vendor Homepage: https://eu.dlink.com Version: A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" Category: Webapps Exploit Author: Giulio Comi CVE : CVE-2018-8898 Date: 20/05/2018 Description The web panel ...

D-Link DSL-3782 Authentication Bypass

Exploit Title: D-Link DSL 3782 - Authentication Bypass Vendor Homepage: https://eu.dlink.com Version: A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" Category: Webapps Exploit Author: Giulio Comi CVE : CVE-2018-8898 Date: 20/05/2018 Description The web panel ...

Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Palo Alto Networks readSessionVarsFromFile Session Corruption', 'Description' = %q This module exploits a chain of vulnerabilities in Palo Alto...

MediaWiki 1.18.0 Installation Path Disclosure Vulnerability - Windows

MediaWiki allows remote attackers to obtain the installation path via vectors related to thumbnail creation. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities

Document Title: =============== Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2121 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13002 CVE-ID: ======= CVE-2018-13002 Release Date:...

Vivotek IP Cameras - Remote Stack Overflow (PoC) Vulnerability

Exploit for multiple platform in category remote exploits STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no...

Geovision Inc. IP Camera/Video/Access Control - Multiple Remote Command Execution / Stack Overflow /

Exploit for hardware platform in category remote exploits STX Subject: Geovision Inc. IP Camera/Video/Access Control Multiple Remote Command Execution - Multiple Stack Overflow - Double free - Unauthorized Access Attack vector: Remote Authentication: Anonymous no credentials needed Researcher:...

Geovision Inc. IP Camera/Video/Access Control - Multiple Remote Command Execution / Stack Overflow / Double Free / Unauthorized Access

STX Subject: Geovision Inc. IP Camera/Video/Access Control Multiple Remote Command Execution - Multiple Stack Overflow - Double free - Unauthorized Access Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis November 2017 PoC: https://github.com/mcw0/PoC Python...