CVE-2017-7756

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests XHR. This could result in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

CVE-2017-7756

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests XHR. This could result in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

CVE-2018-1269

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

CVE-2018-1269

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

CVE-2018-1269

CVE-2018-1269 affects Cloud Foundry Loggregator. The issue arises when building certain HTTP requests: errors thrown during construction aren’t handled, which can leave TCP connections dangling. This enables a remote authenticated user to cause denial of service by crafting malicious requests tha...

CVE-2018-1000195

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful 200 or not...

Clustering App Attacks with Machine Learning Part 1: A Walk Outside the Lab

A lot of research has been done on clustering attacks of different types using machine learning algorithms with high rates of success. Much of it from the comfort of a research lab, with specific datasets and no performance limitations. At Imperva, our research is done for the benefit of real...

WARDroid Uncovers Mobile Threats to Millions of Users Worldwide

An analysis of 10,000 mobile apps has found that a significant portion of them are open to web API hijacking – something that potentially affects the privacy and security of tens of millions of business users and consumers globally. The root of the threat lies in the inconsistencies that are ofte...

CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials

Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored...

CVE-2018-6237

A vulnerability in Trend Micro Smart Protection Server Standalone 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP requests to potentially cause the file system to fill up, eventually causing a denial of service DoS...

CVE-2018-6237

The connected sources confirm a vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x that enables an unauthenticated remote attacker to coerce the product into processing a flood of specially crafted HTTP requests, potentially exhausting the file system and causing a denial of se...

Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications input type="hidden" name="pw...

Teradek Cube 7.3.6 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications i...

Teradek Slice 7.3.15 Change Password Cross Site Request Forgery

...

Teradek Cube 7.3.6 - Cross-Site Request Forgery

/body...

Teradek Slice 7.3.15 - Cross-Site Request Forgery

Teradek Slice 7.3.15 - Cross-Site Request Forgery...

Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery

Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery input type="hidden" name="pw2" value...

Quest NetVault Backup Multipart Request Authentication Bypass (CVE-2018-1163)

An authentication bypass vulnerability exists in the web interface component of Quest NetVault Backup. The vulnerability is due to how the server handles the HTTP requests...

MyBB 1.8.x Denial of Service Exploit

MyBB Denial of Service Attack - 1.8.x Usage Info MyBB DoS POC Requirements python requests pip install requests Usage; python3 mybbdos.py -t "http://target/" -u username -p password !/usr/bin/env python3 import sys import requests import argparse import random import time def mainargv: global...

Jenkins Plugin Resources Directory Traversal (CVE-2018-6356)

A directory traversal vulnerability exists in Jenkins. The vulnerability is due to insufficient input validation of a request parameter in HTTP requests to the plugin resource directory...