Publicly Attacked Microsoft IIS Zero Day Unlikely to be Patched

Microsoft is unlikely to patch a zero-day vulnerability in an older version of its Internet Information Services IIS webserver that’s been publicly attacked since last July and August. Two researchers from the South China University of Technology in Guangzhou posted a proof-of-concept exploit for...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @albinowax was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you!...

Miele Professional PG 8528 - Web Server Directory Traversal（CVE-2017-7240）

Risk Information: Risk Factor: Medium CVSS Base Score: 5.0 CVSS Vector: CVSS2AV:N/AC:L/Au:N/C:P/I:N/A:N CVSS Temporal Vector: CVSS2E:POC/RL:OF/RC:C CVSS Temporal Score: 3.9 Timeline: 2016-11-16 Vulnerability discovered 2016-11-10 Asked for security contact 2016-11-21 Contact with Miele product...

Miele Professional PG 8528 - Directory Traversal

Exploit for hardware platform in category web applications Title: ====== Miele Professional PG 8528 - Web Server Directory Traversal Author: ======= Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG CVE-ID: ======= CVE-2017-7240 Risk Information: ================= Risk Factor: Medium CVSS...

CVE-2017-7240

An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information t...

CVE-2017-7240

An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information t...

Miele Professional PG 8528 - Directory Traversal

Title: ====== Miele Professional PG 8528 - Web Server Directory Traversal Author: ======= Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG CVE-ID: ======= CVE-2017-7240 Risk Information: ================= Risk Factor: Medium CVSS Base Score: 5.0 CVSS Vector: CVSS2AV:N/AC:L/Au:N/C:P/I:N/A:N...

Miele Professional PG 8528 - Directory Traversal

Miele Professional PG 8528 - Directory Traversal Title: ====== Miele Professional PG 8528 - Web Server Directory Traversal Author: ======= Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG CVE-ID: ======= CVE-2017-7240 Risk Information: ================= Risk Factor: Medium CVSS Base Score:...

Microsoft Edge read:// urlhandler Information Disclosure Vulnerability (CVE-2017-0065 )

This exploit was reported to Microsoft and I was acknowledged for doing so. The exploit has been patched on March 14th 2017 under names cve-2017-0065 and MS17-007 and will not work if related patches are applied. Sourcecode is provided for educational purposes only. General This exploit requires...

Goahead webserver <= 2.1.8-path bypass-sensitive File Download vulnerability

1 Introduction Goahead webserver is an embedded OpenSource server that can be build on a lot of systems CE, Ecos, GNU/Linux, Lynx, MacOS, NW, QNX4, VXWORKS, Win32 and others. It is supported by a lot of companies that use it for their projects and it is also used like "base" for other webservers,...

BrainDamage - A fully featured backdoor that uses Telegram as a C&C server

A python based backdoor which uses Telegram as C&C server. /\ /.\ ,.-'/ ",'-., -^ /-^: | \ | \ | | | | | | | | Coded by: Mehul [email protected] -- Github: https://github.com/mehulj94 -- Twitter: https://twitter.com/wayfarermj -- For windows only | | | | | | | | | / / | | | | | '/ / |...

Design/Logic Flaw

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2016-8017

CVE-2016-8017 is a concrete vulnerability in McAfee VirusScan Enterprise for Linux (VSEL) up to version 2.0.3 where the web interface handles special elements (tplt) in user input, enabling an authenticated remote attacker to read files on the webserver. The underlying issue is a Special Element ...

Code injection

An issue was discovered in Eaton xComfort Ethernet Communication Interface ECI Versions 1.07 and prior. By accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access files without authenticating...

CVE-2016-9368

An issue was discovered in Eaton xComfort Ethernet Communication Interface ECI Versions 1.07 and prior. By accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access files without authenticating...

Attacks Heating Up Against Apache Struts 2 Vulnerability

Public attacks and scans looking for exposed Apache webservers have ramped up dramatically since Monday when a vulnerability in the Struts 2 web application framework was patched and proof-of-concept exploit code was introduced into Metasploit. The vulnerability, CVE-2017-5638, was already under...

Evostream Media Server 1.7.1 (x64) - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on:...

Evostream Media Server 1.7.1 Denial Of Service

Exploit Title: Evostream Media Server 1.7.1 a Built-in Webserver DoS Date: 2017-03-07 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://evostream.com/software-downloads/ Version: 1.7.1 Tested on: Windows Server 2008 R2 Standard x64 CVE : CVE-2017-64...