UPDATE: XSStrike 3.1.2

PenTestIT RSS Feed My initial post about this advanced XSS detection and exploitation suite was almost an year ago! Three days ago, an update - XSStrike 3.1.2 was released. This is a post that documents these changes. What is XSStrike? XSStrike is a Cross Site Scripting detection suite equipped...

CVE-2018-20172

An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...

CVE-2018-20172

An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...

Design/Logic Flaw

An issue was discovered in Nagios XI before 5.5.8. The rssurl parameter of rssdashlet/magpierss/scripts/magpieslashbox.php is not filtered, resulting in an XSS vulnerability...

WordPress rss-feed-post-generator-echo 1.0.0 Database Disclosure

Exploit Title : WordPress rss-feed-post-generator-echo Plugins 1.0.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 03/12/2018 Vendor Homepage : wordpress.org/plugins/echo-rss-feed-post-generator-free-version/ +...

WordPress 4.0.x < 4.0.21 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 4.2.x < 4.2.18 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 4.1.x < 4.1.21 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 3.8.x < 3.8.24 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 4.8.x < 4.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

CVE-2018-16235

Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget...

CVE-2018-16235

Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget...

Code injection

Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget...

CVE-2018-16235

CVE-2018-16235 affects Telligent Community: 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725. The vulnerability is an XSS via the Feed RSS widget. The connected documents confirm the affected product family and versions but do not provide detailed...

CVE-2018-16235

Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget...

MyBB 1.8.17 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB 1.8.17 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://mybb.com/download/ Version: 1.8.17 Tested on: Ubuntu 18.04 CVE: CVE-2018-15596 1. Description: On the forum RSS...

MyBB 1.8.17 - Cross-Site Scripting

MyBB 1.8.17 - Cross-Site Scripting Exploit Title: MyBB 1.8.17 - Cross-Site Scripting Date: 2018-08-11 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://mybb.com/download/ Version: 1.8.17 Tested on: Ubuntu 18.04 CVE: CVE-2018-15596 1. Description: On the forum RSS...

FreeBSD : mybb -- vulnerabilities (db2acdac-b5a7-11e8-8f6f-00e04c1ea73d)

mybb Team reports : High risk: Image MyCode 'alt' attribute persistent XSS. Medium risk: RSS Atom 1.0 item title persistent XSS. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques...

MyBB 1.8.17 Cross Site Scripting

Exploit Title: MyBB 1.8.17 - Cross-Site Scripting Date: 2018-08-11 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://mybb.com/download/ Version: 1.8.17 Tested on: Ubuntu 18.04 CVE: CVE-2018-15596 1. Description: On the forum RSS Syndication page you can generate a URL for...

MyBB 1.8.17 - Cross-Site Scripting

Exploit Title: MyBB 1.8.17 - Cross-Site Scripting Date: 2018-08-11 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://mybb.com/download/ Version: 1.8.17 Tested on: Ubuntu 18.04 CVE: CVE-2018-15596 1. Description: On the forum RSS Syndication page you can generate a URL for...