5618 matches found
Samsung Security Manager 1.4 ActiveMQ Broker Service PUT Method Remote Code Execution
This is an exploit against Samsung Security Manager that bypasses the patch in ZDI-15-156 & ZDI-16-481 by exploiting the vulnerability against the client-side. This exploit has been tested successfully using IE, FireFox and Chrome by abusing a GET request XSS to bypass CORS and reach the vulnerab...
Guppy CMS 5.01.03 Cross Site Scripting
Document Title: =============== Guppy CMS v5.01.03 - Client Side Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1887 Release Date: ============= 2016-07-29 Vulnerability Laboratory ID VL-ID:...
Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability
Document Title: =============== Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1891 Release Date: ============= 2016-08-01 Vulnerability Laboratory ID VL-ID: ==================================...
Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability
Document Title: =============== Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1891 Release Date: ============= 2016-07-31 Vulnerability Laboratory ID VL-ID: ==================================...
ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities
Document Title: =============== ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1890 Release Date: ============= 2016-07-28 Vulnerability Laboratory ID VL-ID: ====================================...
Harvest: Opportunity to set arbitrary cookies
The location hash on a configure page is used to set a cookie value of the same content. Visiting of a page like https://%domain%.harvestapp.com/invoices/configurefoo will result into a foo cookie setting. This value isn't validated at all, which gives an attacker the opportunity to set arbitrary...
ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities
Document Title: =============== ZMS v3.2 CMS - Client Side Cross Site Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1890 Release Date: ============= 2016-07-27 Vulnerability Laboratory ID VL-ID: ====================================...
XSS in client rendered block templates
Overview Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a block. Server side rendering is not affected and is properly escaped. Recommendation Update to version 1.1.4 or later. References - PR 61 - PR 513 - GitHub Advisory...
OWASP Mth3l3m3nt Framework - Penetration Testing Aiding Tool And Exploitation Framework
OWASP Mth3l3m3nt Framework is a penetration testing aiding tool and exploitation framework. It fosters a principle of attack the web using the web as well as pentest on the go through its responsive interface. Modules Packed in so far are: Payload Store Shell Generator PHP/ASP/JSP/JSPX/CFM Payloa...
The complete guide to Go net/http timeouts
I got an occasion to do a deep dive into net/http recently, and wrote a post about all the different timeouts you can set on the client and server side. How they work, how they interact and how to use them. The complete guide to Go net/http timeouts | CloudFlare Blog archive...
Belkin AC1200 Router Firmware 1.00.27 - Authentication Bypass
''' Exploit Title: Belkin Router AC1200, Firmware: 1.00.27 - Authentication Bypass Date: 5/11/2016 Exploit Author: Gregory Smiley Contact: [email protected] Vendor Homepage: http://www.belkin.com Version: Firmware: 1.00.27 Tested on:F9K1113 v1 1. Description: The Belkin AC1200 is vulnerable to...
The vulnerability of the Zyxel ZLD operating system, which allows a malicious individual to trigger a service failure.
The Web interface of the Zyxel ZyWALL USG 300 network switch/router contains a vulnerability related to authentication on the client side. This allows a malicious individual to obtain device administrator privileges by manipulating the “IsAdmin” parameter...
BMW - (Token) Client Side Cross Site Scripting Vulnerability
Document Title: =============== BMW - Token Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability Magazine:...
Iranian Weblog Services v3.3 CMS - Multiple Vulnerabilities
Document Title: =============== Iranian Weblog Services v3.3 CMS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1862 CWE-89 CWE-79 CWE-264 http://cwe.mitre.org/data/definitions/89 http://cwe.mitre.org/data/definitions/79...
Informatica: [careers.informatica.com] Reflected Cross Site Scripting to XSS Shell Possible
Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts also commonly referred to as a malicious payload into a legitimate website or web application. XSS is amongst the most rampant of web application vulnerabilities and...
Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability
Document Title: =============== Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1855 Release Date: ============= 2016-06-06 Vulnerability Laboratory ID VL-ID: ====================================...
Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability
Document Title: =============== Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1855 Release Date: ============= 2016-06-05 Vulnerability Laboratory ID VL-ID: ====================================...
SOL77535578 - Multiple Java SE client-side vulnerabilities
Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...
AVAST (Shop) #18 - Multiple Client Side XSS Vulnerabilities
Document Title: =============== AVAST Shop 18 - Multiple Client Side XSS Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1635 Release Date: ============= 2016-05-25 Vulnerability Laboratory ID VL-ID: ====================================...
