Mitsubishi Electric MELSEC iQ-R

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC iQ-R Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Session Fixation, NULL Pointer Dereference, Improper Access...

Tailor MS 1.0 - Reflected Cross-Site Scripting

Exploit Title: Tailor MS 1.0 - Reflected Cross-Site Scripting Exploit Author: Bobby Cooke boku & Adeeb Shah @hyd3sec Date: 2020-09-14 CVE ID: CVE-2020-23835 Vendor Homepage: https://www.sourcecodester.com Software Link:...

GHSA-33C7-2MPW-HG34 Log injection in uvicorn

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

Design/Logic Flaw

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

UBUNTU-CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

CVE-2020-7694

This CVE affects all versions of uvicorn. The request logger is vulnerable to ASNI escape sequence injection: when handling HTTP requests, the logger logs the URL after urllib.parse.unquote processes percent-encoded characters, enabling special-meaning ANSI codes to affect terminal emulators disp...

CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

PT-2020-19717

Name of the Vulnerable Software and Affected Versions uvicorn affected versions not specified Description The request logger in uvicorn is susceptible to ANSI escape sequence injection. When the package logs HTTP request details to the console or a log file, it can process crafted URLs with...

Basecamp: HTTP request smuggling on Basecamp 2 allows web cache poisoning

It is found that an authenticated Basecamp 2 user can desync front and backend servers and poison the socket with harmful response for the next visitor. During redirect probe, It also appears that front-end infrastructure performs caching of content. Using HTTP request smuggling attack, It is...

CVE-2020-11839

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

CVE-2020-11839

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

Cross site scripting

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

CVE-2020-11839

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

CVE-2020-11839

The CVE-2020-11839 entry affects Micro Focus ArcSight Logger, specifically versions 6.6.1 through 7.0.1. The vulnerability is a Cross-Site Scripting (XSS) issue in the web application caused by insufficient validation of client-side data, with potential remote exploitation leading to XSS or infor...

CVE-2020-11839: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting XSS or information disclosure...

PT-2020-12885

Name of the Vulnerable Software and Affected Versions Micro Focus ArcSight Logger versions 6.6.1 through 7.0.1 Description The issue is related to a Cross Site Scripting XSS vulnerability that could be remotely exploited, potentially resulting in Cross-Site Scripting XSS or information disclosure...

h1-ctf: [h1-2006 2020] CTF Walkthrough

h1-2006-ctf Writeup June 2020 https://hackerone.com/h1-ctf/ The Competition Begins! The tweet announces the CTF challenge. Looks like we will need to find a way to process some payments. F863442 Initial Exploring Reading up on the extended description at https://hackerone.com/h1-ctf/ reveals that...

h1-ctf: [H1-2006 2020] Writeup

^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$ Prologue The CTF was announced in a Hacker0x01 tweet. The goal is to make payments from Marten Mickos' account on BountyPayHQ. The announcement tweet was followed shortly by a retweet of BountypayHQ, an account made for the event. BountypayHQ has one...

h1-ctf: h1-ctf writeup , finally paid the payments by chaining multiple bugs

Summary: Ultimate aim is to pay the payments of hackerone using bounty pay with no use privileges at starting. Given scope is : .bountypay.h1ctf.com Enumerated subdomains are : 1. www.bountypay.h1ctf.com 2. app.bountypay.h1ctf.com 3. staff.bountypay.h1ctf.com 4. api.bountypay.h1ctf.com 5...