9067 matches found
h1-ctf: [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret document
Hi! Summary Multiple chained vulnerabilities lead to leaking secret documents. Improper sanitization in registration allows an attacker to create a QR recover code for any email address. This leads to an account takeover. Using that technique on jobert's account, attacker can access the support...
h1-ctf: [h1-415 2020] My writeup on how to retrieve the special secret document
Summary: An attacker without any privilege is able to retrieve the special secret document, hosted on the https://h1-415.h1ctf.com website. To do so, multiple steps are required : 1. The authentication must be bypassed to have a licensed account; 2. The support team portal is vulnerable to a blin...
Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.
Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...
Introducing Periscope: Out-of-Band Vulnerability Detection Mechanism in Qualys WAS
Web applications and REST APIs can be susceptible to a certain class of vulnerabilities that can't be detected by a traditional HTTP request-response interaction. These vulnerabilities are challenging to find but provide a way for attackers to target otherwise inaccessible, internal systems. An...
CVE-2019-20361
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability...
PT-2020-10397 · Unknown · Email Subscribers & Newsletters
Name of the Vulnerable Software and Affected Versions: Email Subscribers & Newsletters versions prior to 4.3.1 Description: The issue is related to a blind SQL injection vulnerability. It allowed SQL statements to be passed to the database in the hash parameter. Recommendations: For versions prio...
CVE-2019-20361
There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. Recent assessments: h00die at January 20, 2021 1:48am UTC reported: A blind, time based SQL...
CVE-2020-5307
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...
Complaint Management System 4.0 - (cid) SQL injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Complaint Management System 4.0 - 'cid' SQL injection Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Tested on: Windows 7 CVE : N...
XSpear v1.3 - Powerfull XSS Scanning And Parameter Analysis Tool
XSpear is XSS Scanner on ruby gems Key features Pattern matching based XSS scanning Detect alert confirm prompt event on headless browser with Selenium Testing request/response for XSS protection bypass and reflectedor all params Reflected Params All paramsfor blind xss, anytings Filtered test...
Mail.ru: Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/]
Blind XSS via username in admin panel of technoatom.mail.ru...
CVE-2019-19742
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...
CVE-2019-19742
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...
Cross site scripting
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...
CVE-2019-19742
CVE-2019-19742 affects D-Link DIR-615 routers, where the User Account Configuration page is vulnerable to blind XSS via the name field. Connected sources substantiate a lack of proper input validation on the web UI leading to client-side script execution; exploitation steps reported include inser...
CVE-2019-19742
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field...
Mail.ru: Blind SSRF на calendar.mail.ru при импорте календаря
Blind SSRF in calendar.mail.ru via calendar import functionality...
InnoGames: Blind SQL Injection
Summary of the Issue A Time Based Blind SQL injection vulnerability was detected on www.innogames.com. Using a specifically crafted payload it was possible to extract database entries. Vulnerable endpoint: https://www.innogames.com/ Steps to reproduce: 1. Getting two states for boolean based sql...
Nord Security: Blind SSRF on debug.nordvpn.com due to misconfigured sentry instance
Summary: The debug subdomain uses Sentry for application monitoring and error tracking. This software comes with a feature known as source code scraping turned on by default which makes it is possible to make blind get requests from the server on which it is running. Steps To Reproduce: add detai...