196 matches found
GDI+ Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data...
Ubiquiti Inc.: Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com
Summary This is not a standard vulnerability, but a chain of two more exotic vulnerabilities leading to a full authentication bypass of your SSO login system at sso.ubnt.com via account.ubnt.com. The root cause of this authentication bypass is two-fold: 1. Subdomain ping.ubnt.com was pointing to...
Mail.ru: Same origin policy bypass on e.mail.ru via Cross-Site Flashing
Hello Mail.Ru Security Team, There is a Cross-Site Flashing vulnerability in e.mail.ru. this vulnerability is similar to XSS except it is Flash script execution. Ref : https://www.owasp.org/index.php/TestingforCrosssiteflashingOTG-CLIENT-008 This allow an attacker to execute requests to the...
Microsoft Graphics Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data...
WordPress Add From Server < 3.3.2 Plugin - Cross-Site Request Forgery (Arbitrary File Upload)
Exploit for php platform in category web applications Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin Abstract It was discovered that Add From Server is vulnerabile to Cross-Site Request Forgery. It can be exploited by luring the target user into clicking a specially...
Informatica: [kb.informatica.com] Dom Based xss
Hi! I found Dom based xss on this subdomain https://kb.informatica.com javaScript security is very important, even more in portals where users store their personal data. Attackers can target those portals to find and exploit High-risk JavaScript vulnerabilities like Dom based xss vulnerabilities...
Slack: [Screenhero] Subdomain takeover
Hi, I found out some neglected DNS records that can be exploited to takedown the subdomain of Slack's acquisition feedback.screenhero.com The security issue is that you have CNAME record that points feedback.screenhero.com to a screenhero.uservoice.com, but the problem is that the service is...
Uber: Uber is Flooding my Mobile with SMS Daily like a cron JOB
The Issue is with the design of sending SMS by the uber referrals system, and every day it's flodding my phone number with driver invitaion message To reproduce this scenario i have Fuzz the below request Through OWSAP Zap I fuzzed for 10,000 requests , keep the same Phone number I have used my...
Zendesk: Stored XSS on [your_zendesk].zendesk.com in Facebook Channel
I have found a stored XSS in the Facebook Channel options at https://yourzendesk.zendesk.com/agent/admin/facebook/facebookauth. The XSS is a result of improperly escaping Facebook Page names. Steps to reproduce ------------------------- 1. Create a facebook page with the following title/page name...
Manage Engine EventLog Analyzer 11.0 Build 11000 Cross Site Scripting
Multiple Cross Site Scripting Attack - ManageEngine EventLog Analyzer v.11.0 Build 11000 Overview----------------------------------------------------------------------------------------------------------------------------- Vendor: Manage Engine Vulnerable Product: EventLog Analyzer v.11.0 Build...
Bime: Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io
I noticed BIME is primarily built on Amazon AWS, which spawned my interest. I started looking for DNS entries that were still pointing to S3 buckets that however no longer exist. It appears this was the case for a2.bime.io, which points to an Amazon S3 website bucket in the US East region. Steps ...
ownCloud: The csrf token remains same after user logs in
As the CSRF token doesn't change after login. Any other user that uses the same workstation is vulnerable. A safer way would be to use dynamic CSRF token or just change the token after login, so attacker doesnt get hold of this. Details of the attacks scenario in a shared workstation environment...
Zaption: CSV Excel Macro Injection in Export Response
Scenario: An attacker creates a response like =AND21 in a tour that allows open response or discussion. Then when a user who created this tour clicks analytic and clicks to export responses as csv, he will see TRUE instead of =AND12 Meaning that cell is now active, and an attacker could make a...
Zendesk: Security Missconfiguration in Autologin
Here I am addressing Critical misconfiguration in autologin feature 1. Open the link in the browser https://dashboard.zopim.com/home and enter your username and password and don't tick select the option Always sign in automatically and login 2. now logout from your account 3. now you logged out...
Automattic: Verification code issues for Two-Step Authentication
Hi there, I noticed two issues regarding the verification code that is sent to the phone as Two-Step Authentication for Wordpress accounts. I found out that verification code sent as SMS while enabling Two-Step Authentication can be reused infinitely for login. Issue1 The application does not...
Dropbox Acquisitions: Privilege Escalation at invite feature @hackpad.com
Hey! I would like to report Privilege Escalation @hackpad.com's Invite feature. Description : Hackpad allows admin of the workspace to add/invite users for admin/member/guest etc roles. I can able to grant that access to any one with just one click. Attack Scenario: Lets say you have workspace...
Square: CSRF on adding clients
Authenticate to an account. 2. Trick the victim to submit the following HTML: input type="hidden"...
WeBid 1.0.6 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WeBid 1.0.6 SQL Injection Vulnerability Google Dork: Powered by WeBid Date: 1/9/13 Exploit Author: Life Wasted Vendor Homepage: http://www.webidsupport.com/ Version: Tested on 1.0.6, but could affect other version Tested On: Linux, Windows...
Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE
CVE-2014-1861 Affected versions: 4.3.3 4.3.1 and probably prior versions. Jetro Cockpit Secure Browsing makes use of a client running on a user's workstation in the enterprise's internal network, and a server in the DMZ that connects on the client's behalf to the internet. Attack scenario: User...
Microsoft Windows Shell MSHTA Script Execution in OLE Files (MS05-016) - Ver2 (CVE-2005-0063)
The Windows operating system provides facilities that make it possible to invoke different applications to handle different types of files. This makes it possible for a user to double click on a known image type file, for instance, and by that action launch the proper application to display or ed...