Danyil Vasilenko Bolt Browser Access Control Error Vulnerability

Danyil Vasilenko Bolt Browser is a productivity-oriented mobile browser from Danyil Vasilenko, Australia. The Danyil Vasilenko Bolt Browser suffers from a security vulnerability that originates from a critical information vulnerability incorrectly displayed in the user interface UI on the address...

Popular Mobile Browsers Found Vulnerable To Address Bar Spoofing Attacks

--- Graphic for illustration Cybersecurity researchers on Tuesday disclosed details about an address bar spoofing vulnerability affecting multiple mobile browsers, such as Apple Safari and Opera Touch, leaving the door open for spear-phishing attacks and delivering malware. Other impacted browser...

CVE-2020-7370

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions...

CVE-2020-7370

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions...

Design/Logic Flaw

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions...

CVE-2020-7370 Danyil Vasilenko Bolt Browser Address Bar Spooofing

User Interface UI Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions...

CVE-2020-7370

Bolt Browser (vendor: Danyil Vasilenko)

Mobile Browser Bugs Open Safari, Opera Users to Malware

A set of address-bar spoofing vulnerabilities that affect a number of mobile browsers open the door for malware delivery, phishing and disinformation campaigns. The bugs, reported by Rapid7 and independent researcher Rafay Baloch, affect six browsers, ranging from the common Apple Safari, Opera...

Bolt CMS 3.7.0 XSS / CSRF / Shell Upload Vulnerabilities

Bolt CMS versions 3.7.0 and below suffer from cross site request forgery, cross site scripting, and remote shell upload vulnerabilities that when combined can achieve remote code execution in one click. Bolt CMS = 3.7.0 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.co...

Bolt CMS 3.7.0 XSS / CSRF / Shell Upload

Bolt CMS = 3.7.0 Multiple Vulnerabilities Author - Sivanesh Ashok | @sivaneshashok | stazot.com Date : 2020-03-24 Vendor : https://bolt.cm/ Version : = 3.7.0 CVE : CVE-2020-4040, CVE-2020-4041 Last Modified: 2020-07-03 -- Table of Contents 00 - Introduction 01 - Exploit 02 - Cross-Site Request...

Bolt CMS 3.7.0 Authenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Bolt CMS 3.7.0 - Authenticated Remote Code Execution', 'Description' = %q This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0...

Bolt CMS 3.7.0 Authenticated Remote Code Execution Exploit

This Metasploit module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6.x in order to execute arbitrary commands as the user running Bolt. Valid credentials for a Bolt CMS user are required. This module has been successfully tested against Bolt CMS 3.7.0 running on CentOS 7. Th...

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6. in order to execute arbitrary commands as the user running Bolt. This module first takes advantage of a vulnerability that allows an authenticated user to change the username in /bolt/profile to a PHP system$GET""...

GHSA-2Q66-6CC3-6XM8 CSRF issue on preview pages in Bolt CMS

Impact Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could...

CSRF issue on preview pages in Bolt CMS

Impact Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could...

GHSA-68Q3-7WJP-7Q3J The filename of uploaded files vulnerable to stored XSS

Impact The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to...

The filename of uploaded files vulnerable to stored XSS

Impact The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2020-35955)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS versions prior to 3.7.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Bolt CMS Cross-Site Request Forgery Vulnerability (CNVD-2020-35947)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site request forgery vulnerability exists in Bolt CMS versions prior to 3.7.1. The vulnerability stems from a WEB application that does not adequately validate whether a request is coming from a trusted...

CVE-2020-4041

In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to...