CVE-2019-13226: Improper Link Resolution Before File Access

deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/ in the Helper::temporaryMountDevice function to temporarily mount a file system as root. An unprivileged user can prepare a symlink at this location to have the file system mounted in an arbitrary location. By winning a...

CVE-2019-13227: Improper Link Resolution Before File Access

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled...

CVE-2019-13228: Improper Link Resolution Before File Access

deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix function to download an ISO file, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker...

PT-2019-13193

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3 Description The issue allows an unprivileged user to potentially create or overwrite files in arbitrary file system locations by preparing a symlink attack at the fixed path /tmp/.deepin-clone.log. The...

CVE-2018-17841

SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter...

Sql injection

SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter...

CVE-2018-17841

SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter...

CVE-2018-17841

CVE-2018-17841 affects Scriptzee Flippa Marketplace Clone 1.0. The vulnerability is an SQL injection in the site-search functionality exposed via the sortBy or sortDir parameters. NVD metrics show CVSS v3 base score 9.8 (CRITICAL) with NETWORK attack vector, no privileges required, and high impac...

PT-2019-9525

Name of the Vulnerable Software and Affected Versions Scriptzee Flippa Marketplace Clone version 1.0 Description A SQL injection issue exists via the sortBy or sortDir parameter in the site-search functionality. Recommendations For Scriptzee Flippa Marketplace Clone version 1.0, avoid using the...

CVE-2018-17841: Improper Neutralization of Special Elements used in an SQL Command

SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter...

PT-2019-11173

Name of the Vulnerable Software and Affected Versions: MantisBT versions 1.3.14 and earlier, 2.0.0 Description: An issue was discovered in MantisBT where any user with REPORTER access or above can view any private issue's details, including summary, description, steps to reproduce, and additional...

Changing public flag in Repository Permissions does not reflect on mirrors

h3. Issue Summary When Public flag is enabled/disabled for a mirrored repository, it doesn't sync on corresponding mirrors. h3. Steps to Reproduce Setup BbS Mirror and approve it on upstream. Create a repository in some project, let's say Project A, and set Public flag as Enabled in Repository...

Facebash - Facebook Brute Forcer In Shellscript Using TOR

Facebook Brute Forcer in shellscript using TOR IG: @thelinuxchoice Legal disclaimer: Usage of Facebash for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not...

Arbitrary Code Execution

Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Ha...

drAFL - AFL + DynamoRIO = Fuzzing Binaries With No Source Code On Linux

Original AFL supports black-box coverage-guided fuzzing using QEMU mode. I highly recommend to try it first and if it doesn't work you can try this tool. Usage You need to specify DRRUNPATH to point to drrun launcher and LIBCOVPATH to point to libbinafl.so coverage library. You also need to switc...

Zeebsploit - Web Scanner / Exploitation / Information Gathering

zeebsploit is a tool for hacking searching for web information and scanning vulnerabilities of a web Installation & Usage apt-get install git git clone https://github.com/jaxBCD/Zeebsploit.git cd Zeebsploit chmod +x install ./install python3 zeebsploit.py type 'help' for show modules and follow...

QRLJacker v2.0 - QRLJacking Exploitation Framework

QRLJacker is a highly customizable exploitation framework to demonstrate "QRLJacking Attack Vector" to show how it is easy to hijack services that depend on the QR Code as an authentication and login method, Mainly it aims to raise security awareness regarding all the services using the QR Code a...

Fiverr Clone Script 1.2.2 - SQL Injection / Cross-Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Fiverr Clone Script 1.2.2 - SQL Injection / Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: email protected Vendor Homepage: https://www.phpscriptsmall.com Software Link :...

Fiverr Clone Script 1.2.2 - SQL Injection Cross-Site Scripting

Fiverr Clone Script 1.2.2 - SQL Injection Cross-Site Scripting Exploit Title: Fiverr Clone Script 1.2.2 - SQL Injection / Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: Apr 1, 2019 Vendor Homepage: https://www.phpscriptsmall.com Software...

Fiverr Clone Script 1.2.2 - SQL Injection / Cross-Site Scripting

Exploit Title: Fiverr Clone Script 1.2.2 - SQL Injection / Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: Apr 1, 2019 Vendor Homepage: https://www.phpscriptsmall.com Software Link : https://www.phpscriptsmall.com/product/fiverr-clone-scrip...