1903 matches found
CVE-2020-11582
CVE-2020-11582 affects Pulse Secure Pulse Connect Secure (PCS) clients with Host Checker enabled. The tncc.jar applet on macOS, Linux and Solaris launches a local TCP server on a random port, reachable by local HTTP clients, with the server potentially processing commands (e.g., setcookie) releva...
CVE-2020-11580
CVE-2020-11580 affects Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06 where the tncc.jar applet on macOS/Linux/Solaris, under an enforced Host Checker policy, accepts arbitrary SSL certificates. This can enable a man-in-the-middle by bypassing certificate validation in the Host Checke...
CVE-2020-11580
An issue was discovered in Pulse Secure Pulse Connect Secure PCS through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate...
Mail.ru: [pulse.mail.ru] Доступ к статистике чужих площадок
Few API methods of pulse.mail.ru were not properly restricted and could be used to obtain statistics information for arbitrary domains...
SQL Injection Vulnerability in Yantai Cloud Pulse Network Technology Co.
Yantai Cloud Pulse Network Technology Co., Ltd. is a professional website construction and search engine marketing services provider. Dedicated to small and medium-sized enterprises network marketing services, and website construction, enterprise version of the PC website construction, three-in-o...
SQL injection vulnerability in co***.php page of Yantai Cloud Pulse Network Technology Co.
Yantai Cloud Pulse Network Technology Co., Ltd. is a professional website construction and search engine marketing services provider. Dedicated to small and medium-sized enterprises network marketing services, and website construction, enterprise version of the PC website construction, three-in-o...
Newly Declassified Study Demonstrates Uselessness of NSA's Phone Metadata Program
The New York Times is reporting on the NSA's phone metadata program, which the NSA shut down last year: A National Security Agency system that analyzed logs of Americans' domestic phone calls and text messages cost $100 million from 2015 to 2019, but yielded only a single significant investigatio...
Yantai Cloud Pulse Network Technology Co., Ltd. SQL injection vulnerability exists in Cloud Pulse Network website building system
Yantai cloud pulse network technology limited company cloud pulse network for brands to provide network station building services. There is a SQL injection vulnerability in the Yantai Cloud Vein Network Technology Co., Ltd. website builder system that can be exploited by attackers to obtain...
Disk Pulse Enterprise 12.4.18 Unquoted Service Path
Exploit Title: Disk Pulse Enterprise v12.4.18 x86 - 'Disk Pulse Enterprise' Unquoted Service Path Exploit Author: boku Date: 02/10/2020 Vendor Homepage: http://www.diskpulse.com Software Link: http://www.diskpulse.com/setups/diskpulseentsetupv12.4.18.exe Version: 12.4.18 Tested On: Windows 10...
Sodinokibi Ransomware Behind Travelex Fiasco: Report
The Sodinokibi ransomware strain is apparently behind the New Year’s Eve attack on foreign currency-exchange giant Travelex, which has left its customers and banking partners stranded without its services. The criminals behind the attack are demanding a six-figure sum in return for the decryption...
Exploit for Path Traversal in Ivanti Connect_Secure
pulsexploit Automated script for Pulse Secure SSL VPN exploit...
remote.walink.org Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1030029 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
remotelink.nortonhealthcare.org Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1030028 Security Researcher 0xSkywalker Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting remotelink.nortonhealthcare.org website and its users. Following coordinated and responsible vulnerability disclosure...
secure.unmc.edu Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1025988 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2014-1238
Cross-site scripting XSS vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier...
Cross site scripting
Cross-site scripting XSS vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier...
CVE-2014-1238
Cross-site scripting XSS vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier...
CVE-2014-1238
This CVE (CVE-2014-1238) is a Cross-Site Scripting (XSS) in Gael/Q-Pulse 0.6 and earlier, affecting the UI path ui/common/managedlistdialog.aspx. The vulnerability arises from unvalidated input being inserted into a JavaScript variable named $RootTree, exploitable via a crafted URL (e.g., LookupL...
Pulse Secure VPN - Arbitrary Command Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pulse Secure VPN Arbitrary Command Execution', 'Description' = %q This module exploits a post-auth command injection in the Pulse Secure VPN serv...
Pulse Secure VPN Arbitrary Command Execution Exploit
This Metasploit module exploits a post-auth command injection in the Pulse Secure VPN server to execute commands as root. The env1 command is used to bypass application whitelisting and run arbitrary commands. Please see related module auxiliary/gather/pulsesecurefiledisclosure for a pre-auth fil...