hardCIDR - Linux Bash Script To Discover The Netblocks, Or Ranges, Owned By The Target Organization

A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE Europe/Asia/Middle East...

ptca.org Cross Site Scripting vulnerability OBB-3285613

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Daggerfly APT Deploys MgBot to Target African Telecoms Organization

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Daggerfly advanced persistent threat group has been observed using previously unseen plugins from the MgBot malware framework in a recent campaign. To receive real-time threat advisories, please foll...

How to put your organization’s cloud security strategy into action

CISOs of Paramount, Aon and Wiz reveal their secrets for creating a future-proof approach to cloud security...

CVE-2014-2912

The connected document describes an insecure tempfile usage in Ansible, where temporary file names are derived from the system time, enabling an attacker to guess the filename and potentially disclose sensitive information. No product versions, exact vulnerability scope, or patch details are prov...

CVE-2014-1865

The CVE-2014-1865 entry is supported by a Veracode advisory (VERACODE:4217) describing an information-disclosure vulnerability in fat_free_crm where password-related attributes — password_hash , password_salt , and password_confirmation — are not filtered from logs, exposing sensitive data to mal...

CVE-2014-1866

The connected VERACODE entry documents a vulnerability in fat_free_crm: Information leakage via error pages. The root cause is that consider_all_requests_local is set to true by default in production, causing 404 and 500 error pages to expose server setup information. The document does not provid...

CVE-2014-9086

The connected Veracode entry identifies a vulnerability in ImageMagick characterized as an information disclosure through a file descriptor leak caused by a corrupted file. Affected component: ImageMagick’s handling of file inputs may leak file descriptors, enabling exposure of sensitive data. Ro...

CVE-2014-1862

The connected document identifies a concrete issue in fat_free_crm: unauthorised new user signup due to users_controller not preventing account creation via crafted POST requests. This results in unapproved signups and potential misuse. The description does not provide a remediation. No other aff...

CVE-2017-9672

Technical details for CVE-2017-9672 are not publicly available in the provided documents. Monitor for updates from the issuing organization; no affected products, versions, or exploitation details are specified here.

CVE-2018-9863

The CVE-2018-9863 entry concerns the express-useragent Node.js/ExpressJS middleware. The connected documents reveal a concrete vulnerability: lack of sanitization/escaping of the HTTP User-Agent header , which an attacker can exploit to trigger Cross-site Scripting (XSS) . Impact described across...

CVE-2018-12119

CVE-2018-12119 is a reserved candidate in Initial Description; connected data indicates a Cross-site Scripting (XSS) issue in knowledge_repo due to lack of sanitization of user-supplied parameters (e.g., comments) when rendering templates. The vulnerability is tied to knowledge_repo’s web renderi...

CVE-2017-12968

The connected document provides concrete details for CVE-2017-12968: libexiv2.so is vulnerable to a denial of service (DoS) via a heap-based buffer overflow. The vulnerability exists in basicio.cpp, causing an out-of-bounds write in Exiv2::Image::printIFDStructure. This information confirms the a...

CVE-2018-7646

The connected Veracode entry identifies a denial of service in svgexport caused by a missing timeout when loading an external image. Impact is DoS; no exploit details are provided in the supplied documents. No CVE-specific remediation is stated here; monitor for updates.

CVE-2018-19454

The connected document identifies a concrete vulnerability in yiisoft/yii2: information disclosure caused by credentials (e.g., HTTP auth username/password) being logged in the application’s logging target (\yii\log\Target). An attacker who can access the log files could retrieve these credential...

CVE-2018-8085

Veracode entry VERACODE:13415 documents a SAML Signature Relocation vulnerability affecting passport-wsfed-saml2. The issue arises because the validation function does not ensure the Signature element is located correctly within an Assertion, enabling signature relocation attacks. The provided ma...

CVE-2018-14578

The connected Veracode entry identifies a concrete vulnerability in yiisoft/yii2: CSRF due to unvalidated request methods in yii\web\Request::getMethod(), allowing an attacker to bypass CSRF token checks by downgrading the HTTP method to read methods such as GET, HEAD or OPTIONS.

CVE-2018-8548

The connected VERACODE entry (VERACODE:8014) describes a Remote Code Execution vulnerability in microsoft.chakracore, caused by how the scripting engine renders objects in memory, allowing arbitrary code execution in the context of the authenticated user. The CVE mapping to CVE-2018-8548 is not p...

WHO 安全漏洞

WHO is an online video community application. A security vulnerability exists in WHO versions 1.0.28, 1.0.30, and 1.0.32, which originates from a vulnerability that could allow an attacker to elevate privileges via the TTMultiProvider component...

campbeyonkey.org Cross Site Scripting vulnerability OBB-3252298

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...