Mako contains Cross-site Scripting vulnerability

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting XSS protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element...

mako.co.il Cross Site Scripting vulnerability OBB-2159249

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

bigbang (>=0.0.6 <=0.0.9), bruteforus (=0.1.0) +8 more potentially affected by CVE-2020-36463 via multiqueue (=0.3.2)

multiqueue CARGO version =0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on multiqueue and may be impacted: - bigbang =0.0.6, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.1.6, =0.2.0, =0.5.0 Source cves: CVE-2020-36463 Source advisory:...

bigbang (>=0.0.6 <=0.0.9), bruteforus (=0.1.0) +8 more potentially affected by CVE-2020-36463 via multiqueue (=0.3.2)

multiqueue CARGO version =0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on multiqueue and may be impacted: - bigbang =0.0.6, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.1.6, =0.2.0, =0.5.0 Source cves: CVE-2020-36463 Source advisory:...

Mako Server v2.5, 2.6 OS Command Injection RCE

This module exploits a vulnerability found in Mako Server v2.5, 2.6. It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp. Th...

Mako Server 2.5 Command Injection Exploit

This Metasploit module exploits a vulnerability found in Mako Server version 2.5. It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to...

Mako Server 2.5 - OS Command Injection Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mako Server v2.5 OS Command Injection RCE', 'Description' = %q This module exploits a vulnerability found in Mako Server v2.5. It's possible to...

Mako Server 2.5 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mako Server v2.5 OS Command Injection RCE', 'Description' = %q This module exploits a vulnerability found in Mako Server v2.5. It's possible to...

Mako Web Server 2.5 Multiple Vulnerabilities - Active Check

Mako Web Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mako:makowebserver";...

Mako Server SSRF / Disclosure / Code Execution

SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3391 + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAKO-WEB-SERVER-MULTIPLE-UNAUTHENTICATED-VULNERABILIITIES-SECURITEAM.txt + ISR: ApparitionSec...

Mako Web Server 2.5 - Multiple Vulnerabilities

Exploit for windows platform in category remote exploits + Source: http://hyp3rlinx.altervista.org/advisories/MAKO-WEB-SERVER-MULTIPLE-UNAUTHENTICATED-VULNERABILIITIES-SECURITEAM.txt + ISR: ApparitionSec Vulnerabilities Summary The following advisory describe three 3 vulnerabilities found in Mako...

Mako Web Server 2.5 - Multiple Vulnerabilities

Mako Web Server 2.5 - Multiple Vulnerabilities + SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3391 + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Mako Web Server 2.5 - Multiple Vulnerabilities

SSD Beyond Security: https://blogs.securiteam.com/index.php/archives/3391 + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MAKO-WEB-SERVER-MULTIPLE-UNAUTHENTICATED-VULNERABILIITIES-SECURITEAM.txt + ISR: ApparitionSec...

tplmap - Automatic Server-Side Template Injection Detection and Exploitation Tool

Tplmap short for Template Mapper is a tool that automate the process of detecting and exploiting Server-Side Template Injection vulnerabilities SSTI. This can be used by developers, penetration testers, and security researchers to detect and exploit vulnerabilities related to the template injecti...

Climber - Check UNIX/Linux Systems For Privilege Escalation

Automated auditing tool to check UNIX/Linux systems misconfigurations which may allow local privilege escalation. Dependencies python = 2.7 python-crypto python-mako python-paramiko Note Climber needs Exscript, a Python module and a template processor for automating network connections over...

openSUSE Security Update : python-mako (openSUSE-SU-2010:0383-1)

Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes CVE-2010-2480. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update python-mako-2728. The text descripti...

CVE-2014-2706

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service system crash via network traffic that improperly interacts with the WLANSTAPSSTA state aka power-save mode, related to stainfo.c and tx.c...

Ubuntu 10.04 LTS : mako vulnerability (USN-996-1)

It was discovered that Mako incorrectly filtered single-quote characters when performing html filtering. An attacker could utilize this to perform cross-site scripting attacks. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

Security fix for the ALT Linux 5 package python-module-mako version 0.2.5-alt1.M51.1

Oct. 2, 2010 Vladimir Lettiev 0.2.5-alt1.M51.1 - Fixed CVE-2010-2480 - XSS via inadequate escaping patch from ubuntu + lib/mako/filters.py: use xml.sax.saxutils.escape instead of cgi.escape so we can escape single quotes...

Ubuntu Update for mako vulnerability USN-996-1

Ubuntu Update for Linux kernel vulnerabilities USN-996-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9961.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for mako vulnerability USN-996-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...