323 matches found
Axis SSI - Remote Command Execution / Read Files Vulnerabilities
Exploit for multiple platform in category remote exploits STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions...
Mail.ru: [health.mail.ru] Раскрытие SSI сценариев
SSI template content leaked on invalid HTTP request in health.mail.ru and few more projects. On the moment of reporting, health.mail.ru was in Main scope of bug bounty program...
Axis SSI - Remote Command Execution Read Files
Axis SSI - Remote Command Execution Read Files STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions: The cam...
Axis SSI - Remote Command Execution / Read Files
STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions: The cam must be configure to allow anonymous view Execut...
Arbitrary Code Injection
Symfony is vulnerable to arbitrary code injection attacks. A malicious user can inject and execute arbitrary PHP code with a language="php" attribute of a SCRIPT element through the Symfony\Component\HttpKernel\HttpCache class. This vulnerability only affects applications with ESI or SSI support...
Mail.ru: [realty.mail.ru] XSS, SSI Injection
XSS === PoC Открыть с помощью Internet Explorer https://blackfan.ru/x?r=https://realty.mail.ru/%22--%3e%3csvg/onload=alertdocument.domain%3e/%252e%252e Request GET /"--/.. HTTP/1.1 Host: realty.mail.ru Connection: close SSI Injection === PoC Request-URI также попадает в SSI код GET //"-- HTTP/1.1...
Axis Communications MPQT/PACS SSI format string remote code execution vulnerability vulnerability
No description provided by source...
Axis Communications MPQT/PACS SSI Remote Format String / Code Execution
!/usr/bin/env python2.7 SOF Remote Format String Exploit Axis Communications MPQT/PACS Server Side Include SSI Daemon Research and development by bashis 2016 This format string vulnerability has following characteristic: - Heap Based Exploiting string located on the heap - Blind Attack No output...
sansihotels.com XSS vulnerability
Vulnerable URL: http://www.sansihotels.com/hotels.php?id=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7594362 VIP website...
[SECURITY] [DSA 3276-1] symfony security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3276-1 [email protected] http://www.debian.org/security/ David Prevot May 31, 2015 http://www.debian.org/security/faq -...
CVE-2015-4050
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
CVE-2015-4050
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
CVE-2015-4050
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
Design/Logic Flaw
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
CVE-2015-4050
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
CVE-2015-4050
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...
CVE-2015-4050
CVE-2015-4050 affects Symfony’s HttpKernel FragmentListener when ESI/SSI is enabled. Versions affected: 2.3.19–2.3.28, 2.4.9–2.4.10, 2.5.4–2.5.11, 2.6.0–2.6.7. Root cause: FragmentListener does not verify if the "_controller" attribute is set, enabling remote attackers to bypass URL signing and s...
Debian DSA-3276-1 : symfony - security update
Jakub Zalas discovered that Symfony, a framework to create websites and web applications, was vulnerable to restriction bypass. It was affecting applications with ESI or SSI support enabled, that use the FragmentListener. A malicious user could call any controller via the /fragment path by...
[SECURITY] [DSA 3276-1] symfony security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3276-1 [email protected] http://www.debian.org/security/ David Prevot May 31, 2015 http://www.debian.org/security/faq -...