Cross site scripting

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2018-16327

CVE-2018-16327 concerns a stored XSS vulnerability in Subrion CMS 4.2.1 via the admin panel URL configuration . The description across sources confirms the flaw as stored XSS, but the documents do not provide exploitation steps, affected environments beyond the version, root-cause analysis, or an...

CVE-2018-16314

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

Physics Platform - A Remote Hardware Hacking Platform

Physics platform is a tool for hardware systems e.g: raspberryPi 3B . It retrieves data passing through the network and sends it to a control panel. It works the same way as a botnet by receiving remote commands. you can imagine that as a black box. Physics hardware You can check repository of...

CVE-2018-11502

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF...

Creasotol 1.0 SQL Injection

Exploit Title : Creasotol Admin Panel Bypass Dork : "DiseA+-o Web : www.creasotol.com" Author : &Warrior& Vendor Homepage : https://creasotol.com Date : 23/08/2018 Version : 1.0 Category : Webapps Tested On : windows 10, firefox Proof Of Concept POC: search google dork : "DiseA+-o Web :...

WordPress Tagregator 0.6 Cross Site Scripting

Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting Date: 2018-05-05 Exploit Author: ManhNho Vendor Homepage: https://wordpress.org/plugins/tagregator/ Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip Ref: https://pastebin.com/ZGr5tyP2 Version: 0.6 Tested...

CVE-2018-12579

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...

CVE-2018-12579

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...

CVE-2018-12579

CVE-2018-12579 affects OXID eShop, spanning Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0....

Code injection

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

CVE-2018-15566

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

WordPress Tagregator 0.6 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting Exploit Author: ManhNho Vendor Homepage: https://wordpress.org/plugins/tagregator/ Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip Ref:...

ASUS DSL N10 Authentication Bypass Vulnerability

The ASUS DSL N10 is a wired and wireless modem router. ASUS DSL N10 C1 modem firmware version 1.1.2.217 has the loginauthorization parameter in the post data for authorization to access the admin panel, the data for this parameter is not completely random and an attacker could use old data or dat...

ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass

Title: ASUS-DSL N10 1.1.2.217 - Authentication Bypass Author: AmnBAN team Date: 2018-08-06 Vendor Homepage: https://www.asus.com/Networking/DSLN10C1with5dBiantenna/ Sofrware version: 1.1.2.217 CVE: N/A 1. Description: In ASUS-DSL N10 C1 modem Firmware Version 1.1.2.217 there is loginauthorization...

ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass

ASUS-DSL N10 1.1.2.217 - Authentication Bypass Title: ASUS-DSL N10 1.1.2.217 - Authentication Bypass Author: AmnBAN team Date: 2018-08-06 Vendor Homepage: https://www.asus.com/Networking/DSLN10C1with5dBiantenna/ Sofrware version: 1.1.2.217 CVE: N/A 1. Description: In ASUS-DSL N10 C1 modem Firmwar...

ASUS-DSL N10 1.1.2.2_17 - Authentication Bypass Vulnerability

Exploit for hardware platform in category web applications Title: ASUS-DSL N10 1.1.2.217 - Authentication Bypass Author: AmnBAN team Vendor Homepage: https://www.asus.com/Networking/DSLN10C1with5dBiantenna/ Sofrware version: 1.1.2.217 CVE: N/A 1. Description: In ASUS-DSL N10 C1 modem Firmware...

Description of the security update for Office 2013: August 14, 2018

Description of the security update for Office 2013: August 14, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow information disclosure if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

A week in security (August 6 – August 12)

Last week, we published a review of exploit kits, talked about everyday tech that can give you a headache, and showed how to protect RDP access from ransomware. We also published a study on the true cost of cybercrime. Other news: Discovered at Black Hat: WhatsApp "message manipulation" Source: T...