EFS Easy Chat Server 3.1 - Password Reset

EFS Easy Chat Server 3.1 - Password Reset Exploit Title: Easy Chat Server Remote Password Reset Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Pre-Auth Remote Password Reset Severity: Critical...

IPFire 2.19 - Remote Code Execution

IPFire 2.19 - Remote Code Execution Title : IPFire 2.19 Firewall Post-Auth RCE Date : 09/06/2017 Author : 0x09AL https://twitter.com/0x09AL Tested on: IPFire 2.19 x8664 - Core Update 110 Vendor : http://www.ipfire.org/ Software :...

httpd: DoS vulnerability in mod_auth_digest

It was discovered that the modauthdigest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication...

SUSE-SU-2017:1479-1 Security update for ceph

This update provides Ceph 10.2.6, which brings fixes and enhancements: This security issue was fixed: - CVE-2016-9579: Do not abort RGW server when accepting a CORS request with short origin. bsc1014986 These non-security issues were fixed: - common: Add rdbmap to ceph-common. bsc1029482 -...

collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

collectd contains an infinite loop due to how the parsepacket and parsepartsignsha256 functions interact. If an instance of collectd is configured with "SecurityLevel None" and empty "AuthFile" options, an attacker can send crafted UDP packets that trigger the infinite loop, causing a denial of...

PHPCMS v9.6.3 suffers from a file inclusion vulnerability

PHPCMS is a website management software. A file inclusion vulnerability exists in the latest version of phpcms V9.6.3 and below. The vulnerability arises from two main parts, one is the acquisition of authkey, which utilizes the insecurity of random numbers, and the other is based on the logical...

[ASA-201705-16] openvpn: denial of service

Arch Linux Security Advisory ASA-201705-16 ========================================== Severity: High Date : 2017-05-13 CVE-ID : CVE-2017-7478 CVE-2017-7479 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-271 Summary ======= The package openvpn...

CVE-2017-8897

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

CVE-2017-8897

CVE-2017-8897 affects Invision Power Services Community Suite (IPS) 4.1.19.2 and earlier, via the IPS UTF8 Converter v1.1.18. It is a pre-auth reflected Cross-Site Scripting (XSS) vulnerability exploitable through admin/convertutf8/index.php?controller=, potentially allowing a crafted announcemen...

CVE-2017-8897

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

Dovecot SASL Authentication Component Denial of Service (CVE-2016-8652)

A denial of service vulnerability exists in the SASL authentication component of Dovecot server. The vulnerability is due to improper handling of username when processing SASL authentication if auth-policy component has been activated. A remote attacker could exploit this vulnerability by sending...

USN-3279-1: Apache HTTP Server vulnerabilities

It was discovered that the Apache modsessioncrypto module was encrypting data and cookies using either CBC or ECB modes. A remote attacker could possibly use this issue to perform padding oracle attacks. CVE-2016-0736 Maksim Malyutin discovered that the Apache modauthdigest module incorrectly...

Privilege Escalation Through Authentication Bypass

keycloak-auth-utils is vulnerable to privilege escalation attacks. The vulnerability is possible because it does not properly perform the token validation in validateGrant. Therefore, attackers can bypass the authentication with invalid tokens and perform unauthorized access to the restricted...

Accellion FTA Device Cross-Site Scripting Vulnerability

Accellion File Transfer is a web-based file transfer/synchronization system. A cross-site scripting vulnerability exists in the Accellion FTA appliance FTA912180 and prior versions. 允许远程攻击者可以通过courier/1000@/index.html中的authparams参数注入任意的web脚本或HTML...

CVE-2017-8791

An issue was discovered on Accellion FTA devices before FTA912180. There is a home/seos/courier/login.html authparams CRLF attack vector...

CVE-2017-8760

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...

SQL Injection Vulnerability in phpcms 'random' Function

phpcms is a website management software. A SQL injection vulnerability exists in phpcms. Due to lax encryption control of the random function, the value of authkey can be obtained, leading to SQL injection and allowing attackers to exploit the vulnerability to obtain sensitive database informatio...

PHPCMS V9 Has Arbitrary File Read Vulnerability

PHPCMS V9 uses PHP5+MYSQL as the technical basis for development.V9 uses OOP Object Oriented Programming to build the basic operating framework. PHPCMS 9.6.1 version of the existence of arbitrary file reading vulnerability, an attacker can exploit the vulnerability to read any server file,...

Fedora 24 : 1:dovecot (2017-da4ed58fd5)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

Weblate: Running 2 accounts with a single email

Hi, While testing, I found a logic flaw which made me to make two accounts with a single email Reproduction Steps - You need 3 emails Gmail to be precise - Register 2 accounts with 2 different emails - On account 1, add a new email 3rd email using the Google Auth - Then delete the previous email ...