PT-2017-10890

Name of the Vulnerable Software and Affected Versions October CMS build 412 Description The issue allows for stored XSS in the brand logo image name, resulting in JavaScript code execution in the victim's browser. This occurs because the brand logo image name is not properly sanitized, enabling a...

PT-2017-10893

Name of the Vulnerable Software and Affected Versions October CMS build 412 Description The issue allows for PHP code execution in the asset manager functionality, which can result in site compromise and potentially affect other applications on the server. Recommendations For October CMS build 41...

October CMS File Path Modification Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A file path modification vulnerability exists in the asset movement feature of October CMS build 412. An attacker can exploit this vulnerability to create malicious files on the server...

CVE-2017-1000197: Undefined Security Weakness

October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server...

CVE-2017-1000195: Deserialization of Untrusted Data

October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server...

PT-2017-10892

Name of the Vulnerable Software and Affected Versions October CMS build 412 Description The issue allows for PHP object injection in the asset move functionality, which can result in the ability to delete files, limited by file permissions on the server. Recommendations For October CMS build 412,...

October CMS Apache Configuration Modification Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. October CMS build 412 suffers from an Apache configuration modification vulnerability. The vulnerability can be exploited to compromise a website and other applications on the server via the file upload feature...

PT-2017-10894

Name of the Vulnerable Software and Affected Versions October CMS build 412 Description The issue allows for file path modification in the asset move functionality, potentially resulting in the creation of malicious files on the server. Recommendations For October CMS build 412, update to a versi...

CVE-2017-1000194: Unrestricted Upload of File with Dangerous Type

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...

CVE-2017-1000193: Improper Neutralization of Input During Web Page Generation

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000196: Improper Control of Generation of Code

October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server...

WhatsApp 2.17.52 - Memory Corruption Exploit

Exploit for iOS platform in category dos / poc !/usr/bin/env python -- coding: utf-8 -- Found this and more exploits on my open source security project: http://www.exploitpack.com Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Date and time of release: 11 October 2017 Tested on:...

Threat Outbreak Alert RuleID31151: Email Messages Distributing Malicious Software on October 31, 2017

Medium Alert ID: 55736 First Published: 2017 October 31 15:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31151 may contain the following files: Name |...

CVE-2017-10309

creationtimestamp| type| source ---|---|--- 2017-10-30 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43103...

Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

Threat Outbreak Alert RuleID31126: Email Messages Distributing Malicious Software on October 27, 2017

Medium Alert ID: 55716 First Published: 2017 October 27 14:38 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31126 may contain the following files: Name |...

colorway.com XSS vulnerability

Open Bug Bounty ID: OBB-369582 Description| Value ---|--- Affected Website:| colorway.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

Threat Outbreak Alert RuleID31063: Email Messages Distributing Malicious Software on October 26, 2017

Medium Alert ID: 55696 First Published: 2017 October 26 13:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31063 may contain the following files: Name |...

Threat Outbreak Alert RuleID30970: Email Messages Distributing Malicious Software on October 26, 2017

Medium Alert ID: 55693 First Published: 2017 October 26 11:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30970 may contain the following files: Name |...

deohoman.org XSS vulnerability

Open Bug Bounty ID: OBB-367690 Description| Value ---|--- Affected Website:| deohoman.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...