389 security update

CentOS Errata and Security Advisory CESA-2018:2757 An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

RHEL 7 : 389-ds-base (RHSA-2018:2757)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2757 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

389-ds-base: race condition on reference counter leads to DoS using persistent search

A race condition was found in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service...

389-ds-base: Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly

A double-free of a password policy structure was found in the way slapd was handling certain errors during persistent search. A unauthenticated attacker could use this flaw to crash Directory Server...

Vanilla: Persistent XSS via Signatures

Description ----------- The current version of the signature plugin 1.6.1 is vulnerable to persistent XSS as the Format parameter is echoed without encoding. POC --- Prerequisite: Enable the Signatures plugin To place the payload, the following request can be used it's simply the request that is...

8x8: Stored Cross Site Scripting.

Hellow team I got Stored based XSS on your web :D Here Is Step : 1. Go to https://www.easycontactnow.com/ 2. Click "Try For Free" Sign Up 3. It will told you "Enter your details to get started". So Enter your full name like : "alert1 Then put all the other details. 4. Then Confirm your id and...

Apple iOS Accounts Component Information Disclosure Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices, and Accounts is one of the user account components. A security vulnerability exists in the Accounts component in versions of Apple iOS prior to 12. The vulnerability can be exploited by an attacker to read persistent...

Cross site scripting

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode...

CVE-2018-17128

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode...

CVE-2018-17128

Summary: CVE-2018-17128 affects MyBB’s Visual Editor (pre-1.8.19). The issue is a persistent XSS introduced through the Video MyCode in posts, enabling attacker-controlled JavaScript execution in a victim’s browser when replying to a thread. The vulnerability is tied to the Video or videotype han...

CVE-2018-17128

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode...

Netis ADSL Router DL4322D RTK 2.1.1 Cross Site Scripting

Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Scripting Author: Cakes Discovery Date: 2018-09-16 Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK 2.1.1 Tested on OS: Kali Linux CVE: N/A...

Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Netis ADSL Router DL4322D RTK 2.1.1 - Cross-Site Scripting Author: Cakes Vendor Homepage: http://www.netis-systems.com Software Link: http://www.netis-systems.com/Home/detail/id/74.html Tested Version: RTK 2.1.1 Tested on O...

UBUNTU-CVE-2018-14638

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in deletepasswdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service...

CVE-2018-14638

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in deletepasswdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service...

CVE-2018-14638

The CVE-2018-14638 issue affects 389-ds-base; the root cause is a crash in delete_passwdPolicy when persistent search connections terminate unexpectedly, leading to remote denial of service. The vulnerability is described for versions before 1.3.8.4-13, and multiple connected advisories note fixe...

CVE-2018-14638

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in deletepasswdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service...

CVE-2018-14638

A double-free of a password policy structure was found in the way slapd was handling certain errors during persistent search. A unauthenticated attacker could use this flaw to crash Directory Server...

MediaTek Wireless Utility rt2870 Denial Of Service

Exploit Title: MediaTek Wirless Utility rt2870 - Denial of Service PoC Autor: Lawrence Amer Date: 2018-09-13 Vendor: MediaTek Software url: https://click.pstmrk.it/2ts/d86o2zu8ugzlg.cloudfront.net%2Fmediatek-craft%2Fdrivers%2FRT27702870RT307x.zip/K94pHAI/oTs1/oC6CdN114w Tested on OS: Windows 7...

Jorani Leave Management System 0.6.5 Cross Site Scripting

Exploit Title: Jorani Leave Management System 0.6.5 a Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-09-06 Google Dork: N/A Vendor: Benjamin BALET Software Link: https://jorani.org/download.html Affected Version: 0.6.5 and possibly before Patched...