Ubiquiti Administration Portal - Remote Command Execution (via Cross-Site Request Forgery)

Exploit for hardware platform in category web applications !-- KL-001-2016-002 : Ubiquiti Administration Portal CSRF to Remote Command Execution Title: Ubiquiti Administration Portal CSRF to Remote Command Execution Advisory ID: KL-001-2016-002 Publication Date: 2016.06.28 Publication URL:...

Ubiquiti Administration Portal CSRF to Remote Command Execution

Vulnerability Details Affected Vendor: Ubiquiti Affected Product: AirGateway, AirFiber, mFi Affected Version: 1.1.6, 3.2, 2.1.11 Platform: Embedded Linux CWE Classification: CWE-352: Cross-Site Request Forgery CSRF; CWE-77: Improper Neutralization of Special Elements used in a Command 'Command...

Wolf CMS 0.8.2 Arbitrary PHP File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Wolfcms 0.8.2 Arbitrary PHP File Upload Vulnerability', 'Description' = %q This module exploits a file upload vulnerability in...

sNews CMS 1.7.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications + Credits: hyp3rlinx + ISR: APPARITIONSEC Vendor: ============ snewscms.com Product: ================ sNews CMS v1.7.1 Vulnerability Type: =================================== Persistent Remote Command Execution Cross Site Request Forgeries CSR...

Veris: Registeration Link "Jacking&Redirecting"

Hello Team , i found dangerous issue in your register application , once i tried to register , the request was like that : POST /portal/register/ HTTP/1.1 Host: sandbox.veris.in User-Agent: My 'User-Agent' Details Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type:...

op5 7.1.9 - Configuration Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'op5 v7.1.9 Configuration Command Execution', 'Description' = %q op5 an open source network monitoring software. The configurati...

Veris: Unauthenticated CSRF(User can input any value for CSRF Token)

Hello Veris, I believe you have implemented CSRF token on the registration for a reason. In my research, I found that a user supplied CSRF Token would be accepted and even saved in the browser cookie and will be the set token on subsequent request. This report is limited to the Register and Login...

Apache Tomcat 7.0.x < 7.0.68 / 8.0.x < 8.0.32 Multiple Vulnerabilities

Binary data 9313.prm...

[SECURITY] [DLA 481-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u3 CVE ID : CVE-2016-1927 CVE-2016-2038 CVE-2016-2039 CVE-2016-2040 CVE-2016-2041 CVE-2016-2045 CVE-2016-2560 This security update fixes a number of security issues in phpMyAdmin. We recommend you upgrade your phpmyadmin packages. CVE-2016-1927...

DLA-481-1 phpmyadmin - security update

Bulletin has no description...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

Udemy: Csrf on creating course

The investigator thought that since there was a CSRF token sent for a request that does not enforce CSRF he was bypassing it...

Django CMS 3.2.3 Cross Site Scripting

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1820 Release Date: ============= 2016-04-19 Vulnerability Laboratory ID VL-ID: ==================================...

Concrete CMS: ProBlog 2.6.6 CSRF Exploit

Report Because the ProBlogs plugin did not validate the anti-csrf token on a POST request. A victim who is logged in could be fooled into clicking a malicious form styled to look like a link, image, etc which would create a page in their C5 website. Because the ProBlogs plugin does not validate t...

WordPress leenk.me 2.5.0 Cross Site Request Forgery / Cross Site Scripting

I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields are : - facebookmessage - facebooklinkname -...

WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting

WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page...

WordPress leenk.me 2.5.0 Plugin - Cross-Site Request Forgery / Cross-Site Scripting

Exploit for php platform in category web applications I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page wp-content/plugins/leenkme/facebook.php XSS vulnerable Fields a...

Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1820 Release Date: ============= 2016-04-18 Vulnerability Laboratory ID VL-ID: ==================================...

Zend Framework < 2.0.8 / 2.1.x < 2.1.4 Multiple Vulnerabilities

Binary data 9146.prm...

Fedora 23 : phpMyAdmin-4.5.4.1-1.fc23 (2016-e55278763e)

phpMyAdmin 4.5.4.1 2016-01-28 =============================== - Error with PMA 4.4.15.3 - Remove hard dependency on phpseclib phpMyAdmin 4.5.4 2016-01-28 ============================= - live data edit of big sets is not working - Table list not saved in db QBE bookmarked search - While 'changing ...