Directory Traversal

github.com/labstack/echo is vulnerable to directory traversal. The library does not properly sanitize URL paths on windows, allowing a malicious user to traverse the filesystem...

Directory Traversal

github.com/astaxie/beego is vulnerable to directory traversal attacks. The library does not properly sanitize URL paths, allowing a malicious user to gain access to sensitive information...

Information disclosure

Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that attackers will attempt to exploit as a first pass across the application. As they probe the application they will take note of anything that m...

The best Burp plugin I’ve ever seen

Wanted to share with you what IMHO is the most promising Burp Suite plugin that just might transform it to the best penetration tool ever. It’s the Vulners plugin, available for free at github . If you are lazy like me, a build is available here: Installation It’s easy if you know how to deal wit...

CakePHP 2.5.9, 2.6.11 & 2.7.2 Released

CakePHP 2.5.9, 2.6.11 & 2.7.2 Released The CakePHP core team is ready to announce the immediate availability of CakePHP 2.5.9, 2.6.11, and 2.7.2. These releases contain important security updates for applications using prefix routing. Security Issues There are two issues that can impact the...

JBoss Status Servlet Information Gathering

This module queries the JBoss status servlet to collect sensitive information, including URL paths, GET parameters and client IP addresses. This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3. This module requires Metasploit: https://metasploit.com/download Current source:...

Stack overflow

Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service crash or possibly execute arbitrary code via 1 a long LastModified value in an S3 XML response in lib/s3.cpp; 2 a long a path or b bucket in an S3 URL in lib/vnodes3.cpp; or 3 a long c...

CVE-2006-1300

Microsoft .NET framework 2.0 ASP.NET in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."...