zakupka.com XSS vulnerability

Open Bug Bounty ID: OBB-695568 Description| Value ---|--- Affected Website:| zakupka.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mozilla Firefox Spoofing Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 63. A remote attacker can exploit the vulnerability to forge the contents of the protocol registration notification bar...

DHS Webinar: Communicating Cyber Risk to Agency Decision Makers and Mission Owners

DHS Office of Cybersecurity and Communications Assistant Secretary Jeanette Manfra is hosting a webinar on communicating cybersecurity risk issues to federal department and agency executives and mission owners on Tuesday, October 30, 2018, from 12-1 p.m. ET. NCCIC encourages users and...

Adult Website Hack Exposes 1.2M ‘Wife Lover’ Fans

The database underlying an erotica site known as Wife Lovers has been hacked, making off with user information protected only by a simple-to-crack, outdated hashing technique known as the DEScrypt algorithm. Over the weekend, it came to light that Wife Lovers and seven sister sites, all similarly...

Modbus Poll 7.2.2 - Denial of Service (PoC)

Modbus Poll 7.2.2 - Denial of Service PoC Exploit Title: Modbus Poll 7.2.2 - Denial of Service PoC Discovery by: Cemal Cihad ÇİFTÇİ Discovery Date: 2018-10-19 Tested Version: 7.2.2 Vulnerability Type: DOS Tested on OS: Windows XP Professional Service Pack 3 Vendor Homepage:...

Joomla! < 3.8.13 ACL Violation Vulnerability

If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2018-17855

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself...

CVE-2018-17855

CVE-2018-17855 affects Joomla! before 3.8.13. It describes an ACL/verification flaw in com_users: if an attacker gains access to a user’s mail account who can approve admin verifications during registration, they can activate themselves. The vulnerability is documented across multiple sources (NV...

Imperva SecureSphere 13 - Remote Command Execution

Imperva SecureSphere 13 - Remote Command Execution Title: Imperva SecureSphere 13 - Remote Command Execution Author: rsp3ar Date: 2018-10-08 Vendor: https://www.imperva.com/products/securesphere/ CVE: N/A Version: 13.0.10, 13.1.10, 13.2.10 Tested on: SecureSphere Virtual Appliance Description PWS...

Chamilo LMS 1.11.8 firstname Cross Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-06 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS:...

Imperva SecureSphere PWS Command Injection

This module exploits a command injection vulnerability in Imperva SecureSphere 13.x. The vulnerability exists in the PWS service, where Python CGIs didn't properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to command injection. Agent...

QIWI: Возможность регистрации на сайте qiwi.com на любой номер телефона

Summary При регистрации на сайте qiwi.com присылается один и тот же код подтверждения в СМС. Impact Возможность зарегистрироваться под любым новым пользователем за счет перебора кода из СМС...

Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting

Exploit Title: Chamilo LMS 1.11.8 - 'firstname' Cross-Site Scripting Author: Cakes Discovery Date: 2018-10-06 Vendor Homepage: https://chamilo.org Software Link: https://github.com/chamilo/chamilo-lms/releases/download/v1.11.8/chamilo-1.11.8-php5.zip Tested Version: 1.11.8 for php5 Tested on OS:...

bookstation.hu XSS vulnerability

Open Bug Bounty ID: OBB-680026 Description| Value ---|--- Affected Website:| bookstation.hu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

escapefromtarkov.com XSS vulnerability

Open Bug Bounty ID: OBB-678987 Description| Value ---|--- Affected Website:| escapefromtarkov.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03472)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'password' parameter of the users/registration page in...

PicaJet FX 2.6.5 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: PicaJet FX 2.6.5 - Denial of Service PoC Author: Gionathan "John" Reale Software Link: http://www.picajet.com/download/PicaJetFXInstall.exe Tested Version: 2.6.5 Tested on OS: Windows 7 32-bit Steps to Reproduce: Run the python...

WordPress Arigato Autoresponder And Newsletter 2.5 SQL Injection / XSS Vulnerabilities

Exploit for php platform in category web applications Title: Blind SQL injection and multiple reflected XSS vulnerabilities in Wordpress Plugin Arigato Autoresponder and Newsletter v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2018-08-22...

Chongqing to the home network technology limited company to the home to buy treasure APP there is information leakage vulnerability

The home has been purchased treasure to provide second-hand housing, new housing, rental housing, stores, information query, transaction brokerage and other services. CAPTCHA information leakage: This vulnerability is mainly in the registration and password retrieval, the server will return the...

Beijing Huijinxing Real Estate Brokerage Co., Ltd. magic sale APP has SMS bombing vulnerability

MagicSale is a new home distribution platform for institutional cooperation, helping brokers of cooperating institutions to effectively develop "inventory customers" in their hands, corresponding their needs to the new home market, and securely realizing the income of institutions and brokers. Th...