HackerOne: Path traversal leading to limited CSRF on GET requests on two endpoints

Hi team! I've found more endpoints which are vulnerable to the limited CSRF stated in report https://hackerone.com/reports/99708. The endpoints cause a CSRF over GET requests, however, I've been unable to exploit it. The following endpoints are vulnerable to this: Proof of Concept 1. Visit...

CVE-2017-3185

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

Code injection

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances...

CVE-2017-3111

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances...

Cross-Site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because userform.php is getting userID data from GET requests, allowing the attacker to inject arbitrary code into the form and launch XSS attacks...

Design/Logic Flaw

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended...

Code injection

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests...

CVE-2015-4683

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests...

CVE-2016-6311

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

CVE-2016-6311

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

Design/Logic Flaw

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

PT-2017-10738

Name of the Vulnerable Software and Affected Versions GlassFish Server Open Source Edition version 4.1 Description The issue allows for both authenticated and unauthenticated Directory Traversal, which can be exploited by issuing a specially crafted HTTP GET request. Recommendations For GlassFish...

Phishing Attacks

silverstripe/framework is vulnerable to phishing attacks. Remote attackers can leverage the fact that logins can be performed over GET requests to conduct phishing attacks without the victim knowing...

XSStrike - Fuzz and Bruteforce Parameters for XSS

XSStrike is a python which can fuzz and bruteforce parameters for XSS. It can also detect and bypass WAFs. Installing XSStrike Use the following command to download it git clone https://github.com/UltimateHackers/XSStrike/ After downloading, navigate to XSStrike directory with the following comma...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2017-11331)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

PT-2017-4227 · Boa · Boa

Name of the Vulnerable Software and Affected Versions: Boa version 0.94.14rc21 Description: The issue is related to the /cgi-bin/wapopen script in the Boa HTTP server, which is vulnerable to path traversal attacks using the FILECAMERA variable sent via GET requests. This could allow a remote...

CVE-2017-8450

CVE-2017-8450 concerns Elastic Stack: Elastic Kibana X-Pack 5.1.1. The issue is an information-disclosure vulnerability where document and field level security were not properly enforced for multi-search and multi-get requests, potentially allowing users without access to certain documents/fields...