U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @psychomantis!...

EasyPHP Webserver 14.1b2 Privilege Escalation

Exploit Title: EasyPHP-Webserver Service - Privilege Escalation Date: date Exploit Author: Owais Mehtab, Tayeeb Rana Vendor Homepage: www.easyphp.org/ Software Link: http://www.easyphp.org/easyphp-webserver.php Version: 14.1b2 Tested on: Win7 Sp1 C:\Program Files...

Debian DSA-3764-1 : pdns - security update

Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-2120 Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @hassaan was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @hassaan!...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @joshualaurencio was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Blind SQLi in a DoD Website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @akaki was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you!...

Microsoft Edge (Windows 10) - chakra.dll Information Leak Type Confusion Remote Code Execution

Microsoft Edge Windows 10 - chakra.dll Information Leak Type Confusion Remote Code Execution Source: https://github.com/theori-io/chakra-2016-11 Proofs of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40990.zip chakra.dll Info Leak + Type Confusion fo...

PHPMailer Sendmail Argument Injection Exploit

PHPMailer versions up to and including 5.2.19 are affected by a vulnerability which can be leveraged by an attacker to write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed to the sendmail binary. This Metasploit module writes a...

U.S. Dept Of Defense: SQL injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @shakaa1 was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @shakaa1!...

PHPMailer Sendmail Argument Injection

PHPMailer versions up to and including 5.2.19 are affected by a vulnerability which can be leveraged by an attacker to write a file with partially controlled contents to an arbitrary location through injection of arguments that are passed to the sendmail binary. This module writes a payload to th...

3 Critical Zero-Day Flaws Found in PHP 7 — One Remains Unpatched!

Three critical zero-day vulnerabilities have been discovered in PHP 7 that could allow an attacker to take complete control over 80 percent of websites which run on the latest version of the popular web programming language. The critical vulnerabilities reside in the unserialized mechanism in PHP...

U.S. Dept Of Defense: Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████

Details: There is currently a security misconfiguration on plain.php function located on the host http://██████████/ allowing attackers to include webserver contents of their choosing no restriction on filetypes and/or IP addresses, as well as embed malicious javascript payloads in the response v...

U.S. Dept Of Defense: Server side information disclosure

A misconfigured Department of Defense webserver improperly disclosed configuration information when returning an error page. sulemanmalik03 was able to demonstrate this vulnerability by crafting a particularly formatted URL. Thanks sulemanmalik03!...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: SQL Injection vulnerability in a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive information. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: Server side information disclosure on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @sulemanmalik03 was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Time Based SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @psychomantis was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you! The service being used didn't properly sanitize id...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information.@babayaga was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: XXE on DoD web server

A Department of Defense webserver was vulnerable to an XML External Entity XXE processing vulnerability. dawgyg was able to exploit this vulnerability by crafting an XML request that revealed sensitive local system information. Thanks dawgyg!...

U.S. Dept Of Defense: Remote code execution on an Army website

A webserver hosted by the U.S. Army allowed the execution of local shell commands. meals was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks meals!...