4490 matches found
lab-populer.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1167683 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
[slackware-security] libexif
New libexif packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libexif-0.6.22-i486-1slack14.2.txz: Upgraded. This update fixes bugs and security issues: CVE-2018-20030: Fix for...
GitHub Security Lab: CodeQL query to detect SSRF in Python
This bug was reported directly to GitHub Security Lab...
Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting
Exploit Title: Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Dork: N/A Date: 2020-05-06 Exploit Author: Vulnerability-Lab Vendor: http://www.sentrifugo.com/ Link: http://www.sentrifugo.com/download Version: 3.2 Category: Webapps CVE: N/A Document Title: =============== Sentrifugo v3.2 CMS ...
cpCommerce v1.2.8 - (id_document) Blind SQL Injection
Document Title: =============== cpCommerce v1.2.8 - iddocument Blind SQL Injection References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2254 Release Date: ============= 2020-05-08 Vulnerability Laboratory ID VL-ID: ==================================== 2254...
Code Injection in vishwanatharondekar/gitlab-cli
Description The git-lab-cli module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Check there aren't files called HACKED 2. Execute the following commands in another terminal: bash npm i git-lab-cli...
Azure Sphere Security Research Challenge Now Open
The Azure Sphere Security Research Challenge is an expansion of Azure Security Lab, announced at Black Hat in August 2019. At that time, a select group of talented researchers was invited to come and do their worst, emulating criminal hackers in a customer-safe cloud environment. This new researc...
Extreme Networks Aerohive HiveOS <=11.x Remote Denial of Service Exploit
Summary Aerohive HiveOS is the network operating system that powers all Aerohive access points, based on a feature-rich Cooperative Control architecture. HiveOS enables Aerohive devices to organize into groups, or 'hives', which allows functionality like fast roaming, user-based access control an...
Qik Chat v3.0 iOS - (Name) Command Inject Vulnerability
Document Title: =============== Qik Chat v3.0 iOS - Name Command Inject Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2247 Release Date: ============= 2020-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 224...
SaltStack Salt Master Server Root Key Disclosure
This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...
Advanced Persistent Threat 2020 - Golden_hands (DE|EU)
Document Title: =============== Advanced Persistent Threat 2020 - Goldenhands DE|EU References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2256 Document: https://www.vulnerability-lab.com/resources/documents/2256.rar Magazine Article:...
OpenCATS v0.9.4-3 - Multiple Cross Site Vulnerabilities
Document Title: =============== OpenCATS v0.9.4-3 - Multiple Cross Site Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2232 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID: ====================================...
File Explorer v1.4 iOS - Information Disclosure Vulnerability
Document Title: =============== File Explorer v1.4 iOS - Information Disclosure Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2220 Release Date: ============= 2020-04-27 Vulnerability Laboratory ID VL-ID:...
iranlabexpo.ir Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1150309 Security Researcher rahul83636534 Helped patch 40 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting iranlabexpo.ir website and its users. Following...
Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution
Summary Apros Evoluation / Furukawa / ConsciusMap is the Tecnored provisioning system for FTTH networks. Complete administration of your entire external FTTH network plant, including from the ONUs installed in each end customer, to the wiring and junction boxes. Unify all the management of your...
Getting ATT&CKed By A Cozy Bear And Being Really Happy About It: What MITRE Evaluations Are, and How To Read Them
Full disclosure: I am a security product testing nerd. I’ve been following the MITRE ATT&CK Framework for a while, and this week the results were released of the most recent evaluation using APT29 otherwise known as COZY BEAR. First, here’s a snapshot of the Trend eval results as I understand the...
P5 FNIP-8x16A/FNIP-4xSH CSRF Stored Cross-Site Scripting
Summary The FNIP-8x16A is an eight channel relay module used for switching any type of load that doesn’t exceed the specifications. Via its built-in web site and TCP/IP communication, the outputs and inputs can be controlled and monitored from standard network capable devices such as computers,...
GitHub Security Lab: Initial websocket support for Javascript (SockJS)
This bug was reported directly to GitHub Security Lab...