Invalidating opt-in tokens

Date : 2019-04-09 CVEID : CVE-2019-10643 Description Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7. Affected versions Contao 4.7 up to 4.7.2 Suggested solution Update to Contao 4.7.3...

Nexus Repository Manager 3 new vulnerability has been used in mining Trojan spread, users are advised to fix as soon as possible-vulnerability warning-the black bar safety net

Recently, Ali cloud security monitoring to watchbog mining Trojan use the new exposure of the Nexus Repository Manager 3 remote code execution vulnerabilityCVE-2019-7238for attack and mining the events. It is worth noting that this attack Start Time 2 on 24th and 2 on 5 May above products, the...

AirTies Air5341 Modem 1.0.0.12 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: AirTies Air5341 1.0.0.12 Modem CSRF Exploit & PoC Version: AirTies Modem Firmware 1.0.0.12 Tested on: Windows 10 x64 CVE : CVE-2019-6967 Author : Ali Can Gönüllü 0day.today 2019-02-06...

HighPortal 12.5 Cross Site Scripting

Vulnerable Product: HighPortal Affected version: 12.5 Vulnerability Type: XSS CVE: CVE-2018-17964 CWE: CWE-79 Credit: Ali Abdollahi Remote: Yes Description:XSS vulnerability on Aryanic HighPortal version 12.5 via an Add Tags action.Contact: https://twitter.com/aliabdollahi2 References: -...

Microsoft IIS shortname vulnerability scanner

The vulnerability is caused by a tilde character "" in a GET or OPTIONS request, which could allow remote attackers to disclose 8.3 filenames short names. In 2010, Soroush Dalili and Ali Abbasnejad discovered the original bug GET request. This was publicly disclosed in 2012. In 2014, Soroush...

Instagram App 41.1788.50991.0 - Denial of Service (PoC)

Instagram App 41.1788.50991.0 - Denial of Service PoC Exploit Title: Instagram App 41.1788.50991.0 - Denial of Service PoC Exploit Author : Ali Alipour Date: 2018-08-25 Vendor Homepage : https://www.instagram.com/ Software Link Download :...

USN-3440-1 poppler vulnerabilities

It was discovered that Poppler incorrectly handled certain files. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service. CVE-2017-14518, CVE-2017-14520, CVE-2017-14617, CVE-2017-14929, CVE-2017-14975, CVE-2017-14977 It was discover...

Login Bypass Vulnerability in Multiple Ali Smart Series Routers

TouchCloud os is the only smart router os adopted by Alibaba, and all the routers in the Ali Smart series use the TouchCloud firmware program and can be controlled with the Ali Smart app. A login bypass vulnerability exists in several AliSmart series routers, which can be exploited by attackers t...

Threat Outbreak Alert RuleID30560: Email Messages Distributing Malicious Software on September 12, 2017

Medium Alert ID: 55176 First Published: 2017 September 12 17:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30560 may contain the following files: Name ...

Threat Outbreak Alert RuleID30574: Email Messages Distributing Malicious Software on September 12, 2017

Medium Alert ID: 55179 First Published: 2017 September 12 12:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30574 may contain the following files: Name ...

Xiaoming probe test Ali cloud OSS credentials have information leakage vulnerability

Xiaoming tan exam app is a learning mobile app application. Xiaoming Tangkao Ali Cloud OSS credentials have an information leakage vulnerability. The vulnerability is caused by credential leakage due to the use of SDK with accessKeyId and accessKeySecret, endpoint built into the mobile app. An...

Active Wallet AliCloud OSS credentials have information leakage vulnerability

Activity Wallet is a mobile promotional app application from Chengdu Speedway Technology Co. Object Storage Service, abbreviated as OSS, is a massive, secure and highly reliable cloud storage service provided by AliCloud to the public. An information leakage vulnerability exists in the Activity...

ali-wholesale.com XSS vulnerability

Vulnerable URL: http://www.ali-wholesale.com/search/?Keyword=%3E%27%3E%22%3Es%3Ci%3Ei%3Cimg+src%3Dx+onerror%3Dprompt%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Hacking Ali cloud released Windows System the high-risk vulnerability solution-exploits warning-the black bar safety net

4 on 14 November, outside the hacking group discloses a comprising a plurality of Windows Remote exploit tools for the confidential documents. To ensure that the cloud on the user's business security, Ali cloud in 4 month 15 days morning nine points half released a vulnerability announcement and...

Redis CSRF vulnerability analysis and preventive measures-vulnerability warning-the black bar safety net

Redis CSRF vulnerability analysis Recently the netizen exposed a Redis CSRF vulnerability, while Redis author in the latest release of the 3. 2. 7 also carried out the repair, this article on CSRF attack and how to safely use Redis. Ali cloud cloud database Redis version force require password...

Man-in-the-middle Remote Code Execution Vulnerability in Ali Want Want Windows Edition

Aliwangwang is a personal transaction communication software customized for Taobao, which facilitates real-time communication between buyers and sellers in the transaction process. A man-in-the-middle remote code execution vulnerability exists in Ali Want Want for Windows. Since Ali Want Want use...

Viart Shopping Cart 5.0 - Cross-Site Request Forgery Arbitrary File Upload

Viart Shopping Cart 5.0 - Cross-Site Request Forgery Arbitrary File Upload function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "http://localhost/admin/adminfmuploadfiles.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

Viart Shopping Cart 5.0 - Cross-Site Request Forgery / Arbitrary File Upload

function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "http://localhost/admin/adminfmuploadfiles.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader"Accept-Language", "en-US,en;q=0.5";...

Viart Shopping Cart 5.0 CSRF / Shell Upload

function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "http://localhost/admin/adminfmuploadfiles.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader"Accept-Language", "en-US,en;q=0.5";...

Viart Shopping Cart 5.0 - Cross-Site Request Forgery / Arbitrary File Upload

Exploit for php platform in category web applications function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "http://localhost/admin/adminfmuploadfiles.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...