EulerOS 2.0 SP5 : python-requests (EulerOS-SA-2019-1886)

According to the version of the python-requests package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 Note that Tenable Network Security has...

CVE-2019-13532

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller...

Stack overflow

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution...

google.com.ar

Pentest notes for: google.com.ar Exploit Pack Nmap 7.80 scan initiated Fri Sep 13 16:38:25 2019 as: "C:\Program Files x86\Nmap\nmap.exe" -sV -A -oA log/google.com.ar google.com.ar Nmap scan report for google.com.ar 173.194.222.94 Host is up 0.015s latency. rDNS record for 173.194.222.94:...

Astaroth Spy Trojan Uses Facebook, YouTube Profiles to Cover Tracks

Facebook and YouTube profiles are at the heart of an ongoing phishing campaign spreading the Astaroth trojan, bent on the eventual exfiltration of sensitive information. The attack is sophisticated in that it uses normally trusted sources as cover for malicious activities – thus evading usually...

auto-service-abel.de Cross Site Scripting vulnerability

Security Researcher Hchabik Helped patch 2350 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting auto-service-abel.de website and its users. Following...

Google to Experiment 'DNS over HTTPS' (DoH) Feature in Chrome 78

Immediately after Mozilla announced its plan to soon enable 'DNS over HTTPS' DoH by default for Firefox users in the United States, Google today says it is planning an experiment with the privacy-focused technology in its upcoming Chrome 78. Under development since 2017, 'DNS over HTTPS' performs...

Google to Experiment 'DNS over HTTPS' (DoH) Feature in Chrome 78

Immediately after Mozilla announced its plan to soon enable 'DNS over HTTPS ' DoH by default for Firefox users in the United States, Google today says it is planning an experiment with the privacy-focused technology in its upcoming Chrome 78. Under development since 2017, 'DNS over HTTPS' perform...

USN-4129-1: curl vulnerabilities

Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service. CVE-2019-5481 Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker...

PsiXBot Adds PornModule, Google DNS Service to Its Arsenal

The PsiXBot malware has made a few changes in recent weeks, including implementing Google’s DNS over HTTPS DoH and adding the blackmail-ready “PornModule” to its bag of tricks. PsiXBot is a multi-use Windows malware that has a range of capabilities, including keylogging, stealing passwords and...

WordPress 5.2.3 - Cross-Site Host Modification Exploit

Exploit for php platform in category web applications !/usr/bin/perl -w Wordpress Type: Remote Risk: High Solution: Set security headers to web server and no-cache for Cache-Control Simple Attack Scenarios: o This attack can bypass Simple WAF to access restricted content on the web server,...

bee-craft.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-959123 Security Researcher OmniGooch Helped patch 3835 vulnerabilities Received 5 Coordinated Disclosure badges Received 10 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting bee-craft.com website and...

Security Bulletin: A vulnerability in Node.js affects IBM Cloud App Management V2018

Summary There is a vulnerability in Node.js used by IBM® Cloud App Management V2018. Node.js is vulnerable to a denial of service. By establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly to force the connection and associated resources to stay alive for a lo...

bw.rocktwp.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-955365 Security Researcher Gh05tPT Helped patch 6884 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting bw.rocktwp.net website an...

Cisco IronPort C150 Header Injection

!/usr/bin/perl -w Cisco IronPort C150 Remote Header 'Host' Injection Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor Donev is not liable for any...

Design/Logic Flaw

The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service DoS by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time...

Scientific Linux Security Update : python-requests on SL7.x x86_64 (20190806)

Security Fixes : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128255; scriptversion"1.5";...

Default credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

CVE-2019-15497 affects Black Box iCOMPEL 9.2.3 through 11.1.4 (as used in ONELAN Net-Top-Box 9.2.3–11.1.4 and other products). The root cause described is default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP . Impact is consistent with the NVD m...