MyBB 1.8.13 - Cross-Site Scripting

MyBB 1.8.13 - Cross-Site Scripting Exploit Title: XSS in MyBB up to 1.8.13 via installer Date: Found on 05-29-2017 Exploit Author: Pablo Sacristan Vendor Homepage: https://mybb.com/ Version: Version 1.8.13 Fixed in 1.8.13 CVE : CVE-2017-16781 No HTML escaping when returning an $error in...

MyBB 1.8.13 - Cross-Site Scripting

Exploit Title: XSS in MyBB up to 1.8.13 via installer Date: Found on 05-29-2017 Exploit Author: Pablo Sacristan Vendor Homepage: https://mybb.com/ Version: Version 1.8.13 Fixed in 1.8.13 CVE : CVE-2017-16781 No HTML escaping when returning an $error in /install/index.php can lead to an XSS which...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: =======...

Ultimate Instagram Feed <= 1.3 - Authenticated Cross-Site Scripting (XSS)

Author: OmarK The vulnerability lies in the "accesstoken" parameter and can cause reflected XSS vulnerability. The issue is on the file ultimate-instagram-feed/admin/partials/uif-access-token-display.php line 19: the vulnerable code is the following: echo $GET'accesstoken'; There is an echo of th...

AlienVault : SSRF bypass #2 (using octal encoding) on the https://www.threatcrowd.org/domain.php

Description The latest SSRF fixes can be bypassed, using octal encoding of the AWS IP. There is other more general bypass, which can't be fixed using blacklisting - it's reported in the 288183. POC https://www.threatcrowd.org/domain.php?domain=0251.00376.000251.0000376 F237500 Suggested fix As wa...

Xlight FTP Server 3.8.8.5 - Buffer Overflow (PoC)

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Xlight FTP Server x86/x64 - Buffer Overflow Crash PoC Date: 07-11-2017 Vulnerable Software: Xlight FTP Server v3.8.8.5 x86/x64 Vendor Homepage: http://www.xlightftpd.com/ Version: v3.8.8.5 x86/x64 Software Link:...

Xlight FTP Server 3.8.8.5 - Buffer Overflow (PoC)

Xlight FTP Server 3.8.8.5 - Buffer Overflow PoC !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: Xlight FTP Server x86/x64 - Buffer Overflow Crash PoC Date: 07-11-2017 Vulnerable Software: Xlight FTP Server v3.8.8.5 x86/x64 Vendor Homepage: http://www.xlightftpd.com/ Version:...

Zoho ManageEngine Applications Manager 13 SQL Injection

ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64;...

WordPress Userpro Plugin < 4.9.17.1 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Userpro – WordPress Plugin – Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage:...

SMPlayer 17.11.0 - .m3u Buffer Overflow (PoC)

SMPlayer 17.11.0 - .m3u Buffer Overflow PoC !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: SMPlayer 17.11.0 - '.m3u' Crash PoC Date: 05-11-2017 Vulnerable Software: SMPlayer v17.11.0 Vendor Homepage: http://www.smplayer.info Version: v17.11.0 Software Link:...

SMPlayer 17.11.0 - '.m3u' Buffer Overflow (PoC)

!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: SMPlayer 17.11.0 - '.m3u' Crash PoC Date: 05-11-2017 Vulnerable Software: SMPlayer v17.11.0 Vendor Homepage: http://www.smplayer.info Version: v17.11.0 Software Link: http://www.smplayer.info/en/downloads Tested On: Windows 7 x64...

Open-Xchange: IDOR - setAttribute action of user object in API

Note. I selected sandbox.open-xchange.com as the asset in Hackerone but this was tested on a local installation . Hello, There appears to be a possible IDOR vulnerability in the following API endpoint for setting custom attributes:...

Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution

Cisco UCS Platform Emulator 3.12ePE1 - Remote Code Execution Vulnerabilities Summary The following advisory describes two remote code execution vulnerabilities found in Cisco UCS Platform Emulator version 3.12ePE1. Cisco UCS Platform Emulator is the Cisco UCS Manager application bundled into a...

International Islamic University Chittagong: XSS Via error message

Hi Team, found xss via error message. PoC: Navigate to http://119.18.148.140/hrd/login.php?error=%3Cscript%3Econfirm1%3C/script%3E%20ID%20or%20Password%20does%20not%20find. Regards, Mr.R3boot...

Uniview - Remote Command Execution Export Config (PoC)

Uniview - Remote Command Execution Export Config PoC STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config...

Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

Oracle FCDB <= 10.5 Cross Site Scripting Vulnerability

Exploit for multiple platform in category remote exploits Title: Cross Site Scripting - Oracle Flex cube Direct Banking Application 10.5 Application: Oracle FCDB Versions Affected: Oracle Flex cube Direct Banking Software 10.5 Note: The payload will bypass the most of the WAFs running behind the...

X (Formerly Twitter): Open Redirect Protection Bypass

Hi Report 281538 is fixed but Attacker can Bypass this Open Redirect Protection. Give this link https://twitter.com/teams/authorize?targetscreenname=&authorizecallback=//www.facebook.com to authorized victim.Twitter will say him to authorize a different account for create team.After authorization...

Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow (PoC)

Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow PoC / Sync Breeze Enterprise BOF - Ivan Ivanovic Ivanov Иван-дурак недействительный 31337 Team / define WINSOCKDEPRECATEDNOWARNINGS define DEFAULTBUFLEN 512 include include include include DWORD SendRequestchar request, int requestsize WSADA...