Eibiz i-Media Server Digital Signage 3.8.0 Configuration Disclosure

Summary EIBIZ develop advertising platform for out of home media in that time the world called "Digital Signage". Because most business customers still need get outside to get in touch which products and services. Online media alone cannot serve them right place, right time. Description i-Media...

Eibiz i-Media Server Digital Signage 3.8.0 (oldfile) File Path Traversal

Summary EIBIZ develop advertising platform for out of home media in that time the world called "Digital Signage". Because most business customers still need get outside to get in touch which products and services. Online media alone cannot serve them right place, right time. Description i-Media...

GitHub Security Lab: [javascript] CWE-117: CodeQL query to detect Log Injection

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-522 Insecure basic authentication

This bug was reported directly to GitHub Security Lab...

IoT-PT - A Virtual Environment For Pentesting IoT Devices

A new pentesting virtual environment for IoT Devices Download Link : https://drive.google.com/open?id=1XwGqkLax2irSPpwEpeAqypl9vEywzw3D MD5 : d9c20057b14cfa3fb25f744813b828df ; SHA1: 8828d693dc6c809377bab40d2bc26f525685e287 OS info and Requirements Base OS : Lubuntu 18.04 LTS Processors : 2 By...

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion

Summary Digital Signage Software. Description Input passed to the 'data' parameter in 'QH.aspx' for delete action is not properly sanitised before being used to delete files. This can be exploited by an unauthenticated attacker to delete files with the permissions of the web server using their...

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability

Summary Digital Signage Software. Description The application suffers from an unauthenticated file disclosure vulnerability when input passed thru the 'filename' parameter when using the download action or thru 'path' parameter when using the getAll action is not properly verified before being...

GitHub Security Lab: Java: CWE-798 - Hardcoded AWS credentials

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Golang : Improvements to Golang SSRF query

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: LDAP injection vulnerability in Java

This bug was reported directly to GitHub Security Lab...

Building a lab with Server 2019 Server Core and PowerShell …then attacking it!

A lot of people want to get into red teaming but dont know how. Our Andy Gill / @ZephrFish has written about that. One of the most important skills a red teamer needs to have is a plan to fail mentality. By planning to fail you can plan for all eventualities. This is a very common military tactic...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10177 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10177 Source advisory: OSV:GHSA-CQHG-XJHH-P8HF...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10379 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10379 Source advisory: OSV:GHSA-8843-M7MW-MXQM...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-10994 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-10994 Source advisory: OSV:GHSA-VJ42-XQ3R-HR3R...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-11538 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-11538 Source advisory: OSV:GHSA-43FQ-W8QQ-V88H...

GitHub Security Lab: Python : Add query to detect Server Side Template Injection

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-939 - Address improper URL authorization

This bug was reported directly to GitHub Security Lab...

UBICOD Medivision Digital Signage 1.5.1 CSRF Add Super Admin

Summary Medivision is a service that provides everything from DID operation to development of DID Digital Information Display optimized for hospital environment and production of professional contents, through DID product installation, image, video content planning, design work, and remote contro...

Plexus anblick Digital Signage Management 3.1.13 (pagina param) Open Redirect

Summary Advanced multiplatform digital signage solution. Reproduction of multimedia content in a visual and impressive way. Adaptable to any use and to various types of screen or display. Description Input passed via the 'pagina' GET parameter in 'PantallaLogin' script is not properly verified...

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation Through Authorization Bypass

Summary Medivision is a service that provides everything from DID operation to development of DID Digital Information Display optimized for hospital environment and production of professional contents, through DID product installation, image, video content planning, design work, and remote contro...