7771 matches found
CVE-2021-27209
CVE-2021-27209 affects TP-Link Archer C5v 1.7_181221 devices where the management interface transmits credentials encoded in base64 over cleartext HTTP. The root cause is insecure transmission of authentication data in the management UI, enabling potential eavesdropping or credential exposure if ...
CVE-2021-27209
In the management interface on TP-Link Archer C5v 1.7181221 devices, credentials are sent in a base64 format over cleartext HTTP...
Kubernetes: kubectl creating secrets from stringData leaves secret in plain text
Report Submission Form Summary: kubectl creating secrets from stringData leaves secret in plain text Kubernetes Version: $ kubectl version Client Version: version.InfoMajor:"1", Minor:"19", GitVersion:"v1.19.3", GitCommit:"1e11e4a2108024935ecfcb2912226cedeafd99df",GitTreeState:"clean",...
TP-Link Archer C5v Security Vulnerability
A security vulnerability exists in TP-Link Archer C5v 1.7181221 devices, which originates when credentials are sent over plaintext HTTP in base64 format...
Exploit for Path Traversal in Totvs Fluig
Totvs Fluig Platform Fluig is the productivity and...
Exploit for Path Traversal in Totvs Fluig
Totvs Fluig Platform Fluig is the productivity and...
CVE-2021-27177
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server...
Node.JS Remote Code Execution
Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...
Node.JS - 'node-serialize' Remote Code Execution (2)
Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...
Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
The LikeBtn WordPress plugin was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery SSRF. On line 7493 in likebtnlikebutton.php a hook is set to allow unauthenticated ajax calls which will call the function likebtnprx. As the name suggests, this function works as a proxy and can ...
Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
The LikeBtn WordPress plugin was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery SSRF. On line 7493 in likebtnlikebutton.php a hook is set to allow unauthenticated ajax calls which will call the function likebtnprx. As the name suggests, this function works as a proxy and can ...
PT-2021-6812
Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 4.6.0 Description The issue is related to a side-channel vulnerability in base64 PEM file decoding, which allows attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack...
Metasploit Framework 6.0.11 Command Injection
Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit Author: Justin Steven Vendor Homepage: https://www.metasploit.com/ Software Link: https://www.metasploit.com/ Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0 CVE : CVE-2020-7384 !/usr/bin/e...
PT-2021-15666
Name of the Vulnerable Software and Affected Versions: Botan versions prior to 2.17.3 Description: The issue concerns certain decoding and encoding operations, specifically base32, base58, base64, and hex, where constant-time computations are not used. This could potentially lead to timing attack...
HackTools
This is a browser extension for penetration testing, called HackTools. It is a comprehensive tool for web application penetration testing, providing various features such as dynamic shell generation, XSS payload, SQL injection payload, local file inclusion payloads, base64 encoding/decoding, hash...
Nagios XI 5.7.x Remote Code Execution
Exploit Title: Nagios XI 5.7.X - Remote Code Exection RCE Authenticated Date: 19/12/2020 Exploit Author: Haboob Team https://haboob.sa Vendor Homepage: https://www.nagios.com/products/nagios-xi/ Version: Nagios XI 5.7.x Tested on: Ubuntu 18.04 / PHP 7.2.24 & Vendor's custom VM CVE: CVE-2020-35578...
Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
Exploit Title: Nagios XI 5.7.X - Remote Code Execution RCE Authenticated Date: 19/12/2020 Exploit Author: Haboob Team https://haboob.sa Vendor Homepage: https://www.nagios.com/products/nagios-xi/ Version: Nagios XI 5.7.x Tested on: Ubuntu 18.04 / PHP 7.2.24 & Vendor's custom VM CVE: CVE-2020-3557...
CVE-2021-3131
The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter...
