Web Application Penetration Testing Tool: Tracy

Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...

CVE-2017-14487

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...

Lenovo Service Framework Android Remote Code Execution Vulnerability

Lenovo Service Framework Android application is a special application for Lenovo products based on the Android platform from China Lenovo Lenovo Company. A security vulnerability exists in the Lenovo Service Framework Android application, which originates from the program failing to properly...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1189)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could...

From the JS files found in the"authentication bypass"vulnerability-vulnerability warning-the black bar safety net

This article content originating from a private vulnerability Bounty program. In this vulnerability the plan, accept the vulnerability range is limited to target sites of a few public functions. Based on early discovery of issues when I was invited into this plan, the other person Total submitted...

DEBIAN-CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...

CVE-2016-7429

A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. Mitigation If you are going to configure your OS to disable source address checks,...

HackerOne: Ability to monitor reports' submission in real time

Hey , I would like to report an issue with the server responses that allow anyone users to monitor and track the reports' submission and the platform activity . Description : The issue occurs on the endpoint '/reports/reportid.json' due to the difference between server responses for submitted...

python: multiple unbound readline() DoS flaws in python stdlib

It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory...

python: multiple unbound readline() DoS flaws in python stdlib

It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory...

python: multiple unbound readline() DoS flaws in python stdlib

It was discovered that multiple Python standard library modules implementing network protocols such as httplib or smtplib failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory...

CVE-2013-6970

Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928...

Design/Logic Flaw

Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928...

Cyber-Ark Vault user enumeration

Servers unswers are different for wrong username and password...

directory_indexing

This plugin greps every response directory indexing problems. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly whats under the hood: Plugin sour...

Apple QuickTime multiple security vulnerabilities

Multiple memory corruptions on different file formats and server responses parsing and in ActiveX components...

Mandriva Update for fetchmail MDVSA-2012:149 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDVSA-2012:149 fetchmail Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

libxine -- multiple buffer overflows in RTSP

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Stack overflow

Multiple stack-based buffer overflows in Novell GroupWise Messenger GWIM Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbitrary code via "spoofed server responses" that contain a long string after the NMASZTRANSACTIONID field name...

CVE-2008-2703

Multiple stack-based buffer overflows in Novell GroupWise Messenger GWIM Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbitrary code via "spoofed server responses" that contain a long string after the NMASZTRANSACTIONID field name...