Huawei HG255s Directory Traversal

Exploit Title: Server Directory Traversal at Huawei HG255s Date: 07.09.2017 Exploit Author: Ahmet Mersin Vendor Homepage: www.huawei.com Software Link: Not published this modem just used by Turkey Version: V100R001C163B025SP02 POC: https://www.youtube.com/watch?v=n02toTFkLOU&feature=youtu.be...

IWEBSOUL CMS 1.0 SQL Injection Vulnerability

IWEBSOUL CMS version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Title: ======= IWEBSOUL CMS - Multiple SQL Injection Vulnerabilities & Authentication Bypass Introduction: ============== Intrepid Websoul Private Limited - iWebsoul is a rapidly...

IWEBSOUL CMS 1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: ======= IWEBSOUL CMS - Multiple Cross Site Scripting Vulnerabilities Introduction: ============== Intrepid Websoul Private Limited - iWebsoul is a rapidly growing IT Solution provider in India. Team comprehensively works to create a...

Huawei HG255s - Directory Traversal

Huawei HG255s - Directory Traversal Exploit Title: Server Directory Traversal at Huawei HG255s Date: 07.09.2017 Exploit Author: Ahmet Mersin Vendor Homepage: www.huawei.com Software Link: Not published this modem just used by Turkey Version: V100R001C163B025SP02 POC:...

Apache Struts2 S2-053 (CVE-2017-12611)

0x00 基本信息 漏洞编号：S2-053（CVE-2017-12611） 漏洞影响：远程代码执行 影响版本：Struts 2.0.1 -Struts 2.3.33, Struts 2.5 - Struts 2.5.10 漏洞修复：升级至最新版本 0x01 环境搭建 先用struts-2.3.33搭一个freemarker的简单项目（官方推荐的min-lib中就带了freemarker-2.3.22.jar，不用再额外去找了），就用漏洞公告里给的那个写法 运行后，未发现效果 表着急，我们用的是hidden，看看源代码 根据经验，应该是二次解析造成的漏洞，验证一下 0x02 构造POC...

Roteador Wireless Intelbras WRN150 - Cross-Site Scripting

Roteador Wireless Intelbras WRN150 - Cross-Site Scripting Exploit Title: XSS persistent on intelbras router with firmware WRN 250 Date: 07/09/2017 Exploit Author: Elber Tavares Vendor Homepage: http://intelbras.com.br/ Version: Intelbras Wireless N 150Mbps - WRN 240 Tested on: kali linux, windows...

Ultimate HR System <= 1.2 - Directory Traversal / Cross-Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title: HRM - Workable Zone : Ultimate HR System Last Name Other vulnerable fields include: First Name, Contact Number Unauthenticated Directory Traversal: http://localhost.com/download?type=document&filename=../../../../../etc/passwd...

Samsung Internet Browser - SOP Bypass Exploit

Exploit for Android platform in category remote exploits Hi team, below advisory for your reference, Exploit Title: SOP Bypass Date: 06 Septmber 2017 Software Link: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Exploit Author: Dhiraj Mishra Contact:...

Dup Scout Enterprise 9.9.14 - Input Directory Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title : Dup Scout Enterprise v9.9.14 - 'Input Directory' Local Buffer Overflow Date : 04 Sept, 2017 Exploit Author : Touhid M.Shaikh - www.touhidshaikh.com Contact : https://github.com/touhidshaikh Vendor Homepage:...

Rockstar Games: Stored XSS on support.rockstargames.com

In this report, the researcher was able to demonstrate a proof-of-concept exploit for a Stored XSS vulnerability on our Support site at support.rockstargames.com. The POC consisted of two parts; the setup and the trigger. The setup required entering a particular XSS payload in the Title for a new...

NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access) Vulnerability

Exploit for jsp platform in category web applications HTML Decoded PoC: history.pushState'', '', '/' input type="hidden"...

The Next Generation Of Genealogy Sitebuilding SQL Injection

========================================================================================== The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability ==========================================================================================...

Rockstar Games: Stored XSS on member post feed

In this report, the researcher found a Stored XSS vulnerability in Profile Feeds. A POC was provided demonstrating the ability to affect any accessible member's Feed. We improved our filtering to automatically remove the harmful input, specifically including the bypass technique the researcher...

Easy DVD Creator 2.5.11 - Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11...

NethServer 7.3.1611 - Cross-Site Request Forgery Cross-Site Scripting

NethServer 7.3.1611 - Cross-Site Request Forgery Cross-Site Scripting NethServer 7.3.1611 Upload.json CSRF Script Insertion Vulnerability Vendor: NethServer.org Product web page: https://www.nethserver.org Affected version: 7.3.1611-u1-x8664 Summary: NethServer is an operating system for the Linu...

NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access)

HTML Decoded PoC: history.pushState'', '', '/' input type="hidden" name="AccountUsercr...

Easy DVD Creator 2.5.11 Buffer Overflow

!/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11 Software Link: http://www.divxtodvd.net/easydvdcreator.exe...

GSA Bounty: Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

We endorse sp1d3rs's summary! The PR fixing this ticket is here: https://github.com/18F/federalist/pull/1157 Thanks to the 18F team for the great experience, fast fix, and the bounty! The report details i requested the limited disclosure due to lot of sensitive info in the attachments and report...

GSA Bounty: CSRF to change Account Security Keys on secure.login.gov

This may not be in scope and nor be eligible for bounty but I read this in your vulnerability disclosure policy: While not all of our services are in scope for our Bug Bounty program, we do welcome disclosures of vulnerabilities through our Vulnerability Disclosure Policy. We would encourage you ...

Easy DVD Creator 2.5.11 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy DVD Creator 2.5.11 - Buffer Overflow Windows 10 64bit, SEH Date: 26-08-2017 Exploit Author: tr0ubl3m4k3r Vulnerable Software: Easy DVD Creator Vendor Homepage: http://www.divxtodvd.net/ Version: 2.5.11 Software Link: http://www.divxtodvd.net/easydvdcreator.exe...