CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

CVE-2016-8652

The CVE-2016-8652 affects the Dovecot auth component when the auth-policy is enabled. The vulnerability allows a remote attacker to cause a denial-of-service (crash) by aborting authentication without a username, with affected versions listed as Dovecot prior to 2.2.27 (OpenVAS references note a ...

CVE-2016-8652

The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service crash by aborting authentication without setting a username...

ZoneMinder - Multiple Vulnerabilities

Exploit for php platform in category web applications ========================================================================== Product: ZoneMinder Versions: Multiple versions - see inline Vulnerabilities: File disclosure, XSS, CSRF, Auth bypass & Info disclosure CVE-IDs: CVE-2017-5595,...

openSUSE Security Update : python3-sleekxmpp (openSUSE-2017-137)

This update for python3-sleekxmpp fixes the following issues : - Check the origin of roster pushes 2015-8688, 2016-9928, boo1014976. Also see https://gultsch.de/gajimrosterpushandmessageinterce ption.html - An error in legacyauth support was fixed %NASLMINLEVEL 70300 C Tenable Network Security,...

DEBIAN-CVE-2016-6897

Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...

BoZoN 2.4 - Remote Code Execution

BoZoN 2.4 - Remote Code Execution + + Credits / Discovery: John Page + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/BOZON-PRE-AUTH-COMMAND-EXECUTION.txt + ISR: ApparitionSec + Vendor: ============ bozon.pw/en/ Product: =========== BoZoN 2.4 Bozon is a...

BoZoN 2.4 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications + + Credits / Discovery: John Page + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/BOZON-PRE-AUTH-COMMAND-EXECUTION.txt + ISR: ApparitionSec + Vendor: ============ bozon.pw/en/ Product: =========== BoZo...

BoZoN 2.4 - Remote Code Execution

Credits / Discovery: John Page + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/BOZON-PRE-AUTH-COMMAND-EXECUTION.txt + ISR: ApparitionSec + Vendor: ============ bozon.pw/en/ Product: =========== BoZoN 2.4 Bozon is a simple file-sharing app. Easy to...

Malware exploit: Keitaro Tds

Keitaro TDS Type: Auth Bypass Author: Xylitol //////////\ / / / / - / / / / / / / /\ / / / / - / // / / / / / / / / // // ///////////////\nf! \/\\\\\\\/ C Y B E R C R i M E W H Q Keitaro TDS Auth bypass v6.x - v7.7.10 Discovered on.: 28/03/2014 Released on...: 31/10/2016 1 go to...

Malware exploit: Xanity

Type: File Upload Author: Xiphos Research Ltd. TorCTPwn I was having a look at the C&C panel of the Xanity RAT for a bit of amusement, and noticed that it suffers an absurdly trivial shell upload vulnerability, outlined below. See: upload.php and note we can upload whatever the hell we want to a...

Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal

This module exploits a directory traversal vulnerability in Cisco Firepower Management under the context of www user. Authentication is required to exploit this vulnerability. This module requires Metasploit: https://metasploit.com/download Current source:...

UBUNTU-CVE-2016-10012

The shared memory manager associated with pre-authentication compression in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to t...

httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4

It was discovered that in httpd 2.4, the internal API function apsomeauthrequired could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied...

CVE-2016-4028

An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the...

Authentication Bypass

python-social-auth is vulnerable to authentication bypasses. A malicious user can log in once to obtain a genuine verification code and use it to log in to any other account in the system...

WordPress: Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth

Description This report is a variant on report 110801 but with broader vector. 110801 was a XSRF SSRF that allowd unintended GET requests to 0.0.0.0 on port 80, 443 and 8080. This vulnerability uses same entry vector of the press this scrape function but entirely bypasses the ip and port filter...

NTP 4.2.8p8 - Denial of Service

!/usr/bin/env python Exploit Title: ntpd remote pre-auth Denial of Service Date: 2016-11-21 Exploit Author: Magnus Klaaborg Stubman @magnusstubman Website: http://dumpco.re/cve-2016-7434/ Vendor Homepage: http://www.ntp.org/ Software Link:...

Could not sign CSR Caused by: java.io.IOException: Cannot obtain certificate from certsrv authority: 403 Forbidden (ZDM-certsrv/1.0 - 403 16)

XenMobile Client Certificate request responded with a HTTP Response 403 16 Forbidden by the issuing server IIS Log : 2016-10-11 14:42:18 10.1.1.51 POST /certsrv/certfnsh.asp - 443 - 192.168.100.100 ZDM-certsrv/1.0 - 403 16 2148204809 31...