code-maven.com XSS vulnerability

Vulnerable URL: https://code-maven.com/search/%22%3E%3Csvg%20onload=alert%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 06.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 189687 VIP website status:| No...

DELTA - SDN Security Evaluation Framework

DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique. Agent-Manager is the control tower. It takes full control over all...

Multi Gather Maven Credentials Collection

This module will collect the contents of all users settings.xml on the targeted machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'Multi Gather Maven Credentials...

WS-Attacker v1.8 - Modular Framework For Web Services Penetration Testing

WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum http://nds.rub.de/ and the Hackmanit GmbH http://hackmanit.de/ . The basic idea behind WS-Attacker is to provide a functionality to load WSDL...

UPDATE: OWASP Dependency-Check 2.1.0!

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 2.1.0! What I like about this release...

Burp Vulners Scanner - Vulnerability scanner based on vulners.com search API

Burp Suite scanner plugin based on Vulners.com vulnerability database API Search fingerprints in HTTP response inspired by plugin "Software Version Reporter" and check found version in vulners.com vulnerability database Experemental Check unique URLs in vulners.com finding exploits for such paths...

Apache shiro 1.2.4 version of remote command execution vulnerability details-vulnerability warning-the black bar safety net

Search, I found online about apache shiro 1.2.4 version of the vulnerability consolidation report to write too simple, is perhaps the bigwigs speaking of professional, I this noob can't read the reason, specially in the local do a full show. First from the shiro official get shiro 1.2.4 of the...

SDN Security Evaluation Framework: DELTA

DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique. Agent-Manager is the control tower. It takes full control over all...

Fedora 25 : 1:tomcat (2016-f4a443888b)

This updates includes a rebase from tomcat 8.0.32 up to 8.0.36 to resolve : - rhbz1349469 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service and also includes the following bug fixes : - rhbz1341850 tomcat-jsvc.service has TOMCATUSER value hard-coded -...

Fedora 23 : 1:tomcat (2016-0a4dccdd23)

This updates includes a rebase from tomcat 8.0.32 up to 8.0.36 to resolve : - rhbz1349469 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service and also includes the following bug fixes : - rhbz1341850 tomcat-jsvc.service has TOMCATUSER value hard-coded -...

Analyzing TLS Libraries: TLS-Attacker

TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS protocol flow...

Udemy: AWS S3 bucket writable for authenticated aws user

Hey, I found an open S3 Amazon bucket udemy-maven. While I can’t confirm if you own it or not, it appears that it is publicly writable using the aws cli. When I write to udemy-maven, I get: move: ./test.txt to s3://udemy-maven/test.txt And also when I remove file, I get: delete:...

Open Source GPS Tracking System: Traccar

Traccar is an open source GPS tracking system for various GPS tracking devices. This Maven Project is written in Java and works on most platforms with installed Java Runtime Environment. System supports more than 80 different communication protocols from popular vendors. It includes web interface...

KeyBox - A web-based SSH console that centrally manages administrative access to systems

KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys. Key management and administration is based on profiles assigned to defined users. Administrators can login...

Android Studio - The official Android IDE

Android Studio is the official IDE for Android application development, based on IntelliJ IDEA. On top of the capabilities you expect from IntelliJ, Android Studio offers: Flexible Gradle-based build system Build variants and multiple apk file generation Code templates to help you build common ap...

cn.123tool.chen:commons (1.0.0), cn.acooly:acooly-auth-google-authenticator (5.2.1) +681 more potentially affected by CVE-2014-9515 via net.sf.dozer:dozer (>=4.0, <=5.5.1)

net.sf.dozer:dozer MAVEN version =4.0, =1.0.0, =2.1.0 and more Source cves: CVE-2014-9515 Source advisory: SNYK:JAVA-NETSFDOZER-15338467...

CVE-2013-2034

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

CVE-2013-2034

Multiple cross-site request forgery CSRF vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that 1 execute arbitrary code or 2 initiat...

PT-2014-2530 · Apache +1 · Maven +2

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.514 Jenkins LTS versions prior to 1.509.1 Jenkins Enterprise 1.466.x versions prior to 1.466.14.1 Jenkins Enterprise 1.480.x versions prior to 1.480.4.1 Description: The issue allows remote attackers to hijack the...