MantisBT 访问控制错误漏洞

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. An access control error vulnerability exists in MantisBT versions prior to 2.24.4, which stems from the fact th...

MantisBT 安全漏洞

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.24.4, which allows any logged in user who is allowed...

Mantis Bug Tracker 2.24.3 SQL Injection

Exploit Title: Mantis Bug Tracker 2.24.3 - 'access' SQL Injection Date: 30/12/2020 Exploit Author: EthicalHCOP Vendor Homepage: https://www.mantisbt.org/ Version: 2.24.3 CVE: CVE-2020-28413 import requests, sys, time from lxml import etree proxies = "http": "http://127.0.0.1:8080", "https":...

Mantis Bug Tracker 2.24.3 - 'access' SQL Injection

Exploit Title: Mantis Bug Tracker 2.24.3 - 'access' SQL Injection Date: 30/12/2020 Exploit Author: EthicalHCOP Vendor Homepage: https://www.mantisbt.org/ Version: 2.24.3 CVE: CVE-2020-28413 import requests, sys, time from lxml import etree proxies = "http": "http://127.0.0.1:8080", "https":...

MantisBT SQL注入漏洞

MantisBT is a lightweight, free and open source, web-based defect tracking system. A SQL injection vulnerability exists in the "access" parameter of the mcprojectgetusers function in MantisBT 2.24.3. An attacker can exploit this vulnerability via API SOAP to conduct SQL injection attacks...

[SECURITY] [DSA 4818-1] sympa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4818-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2020 https://www.debian.org/security/faq -...

Mantis Bug Tracker 2.3.0 Remote Code Execution

Exploit Title: Mantis Bug Tracker 2.3.0 - Remote Code Execution Unauthenticated Date: 2020-09-17 Vulnerability Discovery: hyp3rlinx, permanull Exploit Author: Nikolas Geiselman Vendor Homepage: https://mantisbt.org/ Software Link: https://mantisbt.org/download.php Version: 1.3.0/2.3.0 Tested on:...

Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)

Exploit Title: Mantis Bug Tracker 2.3.0 - Remote Code Execution Unauthenticated Date: 2020-09-17 Vulnerability Discovery: hyp3rlinx, permanull Exploit Author: Nikolas Geiselman Vendor Homepage: https://mantisbt.org/ Software Link: https://mantisbt.org/download.php Version: 1.3.0/2.3.0 Tested on:...

CVE-2020-7711

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures...

MMS Exploit Part 5: Defeating Android ASLR, Getting RCE

Posted by Mateusz Jurczyk, Project Zero This post is the fifth and final of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. Previous posts are...

Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public

This tool can scan websites with open .git repositories for Bug Hunting/ Pentesting Purposes and can dump the content of the .git repositories from webservers that found from the scanning method. This tool works with the provided Single target or Mass Target from a file list. Installation - git...

[SECURITY] [DSA 4670-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4670-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 29, 2020 https://www.debian.org/security/faq -...

Cross-site Scripting (XSS)

atlasboard-atlassian-package is vulnerable to cross-site scripting XSS. A user who can create or modify issues on JIRA server e.g bug tracker can inject and execute arbitrary JavaScript in a victim's browser...

MantisBT Input Validation Error Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. An input validation error vulnerability exists in versions of MantisBT prior to 1.2.13, which can be exploited by an...

Dr. Memory - Memory Debugger For Windows, Linux, Mac, And Android

Dr. Memory is a memory monitoring tool capable of identifying memory-related programming errors such as accesses of uninitialized memory, accesses to unaddressable memory including outside of allocated heap units and heap underflow and overflow, accesses to freed memory, double frees, memory leak...

PT-2019-14339 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 1.3.20 MantisBT versions prior to 2.22.1 Description: The issue allows for Post Authentication Command Injection, which can lead to Remote Code Execution. Recommendations: For versions prior to 1.3.20, update to...

Fedora 31 : python38 (2019-d11594bf0a)

This is a beta preview of Python 3.8 Python 3.8 is still in development. This release, 3.8.0b4 is the last of four planned beta release previews. Beta release previews are intended to give the wider community the opportunity to test new features and bug fixes and to prepare their projects to...

Kali Linux 2019.2 Release - Penetration Testing and Ethical Hacking Linux Distribution

This release brings the kernel up to version 4.19.28, fixes numerous bugs, includes many updated packages, and most excitingly, features a new release of Kali Linux NetHunter! Kali NetHunter 2019.2 Release NetHunter now supports over 50 devices running all the latest Android versions, from KitKat...

Avahi 0.7 Denial Of Service

Hi! Avahi-daemon in Avahi through 0.7 inadvertently sends Legacy Unicast Responses to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service traffic amplification or obtain potentially sensitive information via port-5353 UDP...

Kali Linux 2018.4 Release - Penetration Testing and Ethical Hacking Linux Distribution

Welcome to our fourth and final release of 2018, Kali Linux 2018.4, which is available for immediate download. This release brings kernel up to version 4.18.10, fixes numerous bugs, includes many updated packages, and a very experimental 64-bit Raspberry Pi 3 image. New Tools and Tool Upgrades...