Paragon Initiative Enterprises: Full Path Disclosure in airship.paragonie.com '/cabins/'

Hello Team, first am so sorry if i test this in your site, since i got problem to install in my own. So when i see your blog i got end point to https://airship.paragonie.com which is "Powered By Airship" or made using Airship CMS. step To Reproduce 1. register an account 2. navigate to...

Paragon Initiative Enterprises: directory information disclose

step: 1. goto https://bridge.cspr.ng/my/files/Hull with your login id 2. upload a file 3. click on "File info" and see full path of file is disclose...

Paragon Initiative Enterprises: Cross-site-Scripting

step: 1: goto https://bridge.cspr.ng/my/account of your account 2. in "Custom Profile field option" check the box and enter xss payload in "display name" field payload: "palert'xss'" 3. update the information 4. open the account in INTERNET EXPLORER 11 and xss will executed note: here server is n...

Paragon Initiative Enterprises: Incomplete fix for #181225 (target=_blank vulnerability)

Hi, I believe the fix for 181225 is incomplete in the rules for Airship wysihtml parser rules. At https://github.com/paragonie/airship/blob/58f96aa0e5002b60e74456502d9bfc9483d77b3d/src/public/js/wysihtml5/parserrules/advancedandextended.js, the 'target' parameter for links is allowed to be...

Zhiyuan A6-m Collaboration Management Software Enterprise Edition Has Violent Breakthrough Vulnerabilities

Zhiyuan A6-m Collaboration Management Software Enterprise Edition is a collaboration management software for small and medium-sized enterprises. A6-m Collaboration Management Software Enterprise Edition suffers from a brute force vulnerability. This vulnerability allows attackers to brute-force...

This Ransomware Malware Could Poison Your Water Supply If Not Paid

Ransomware has been around for a few years, but in last two years, it has become an albatross around everyone's neck, targeting businesses, hospitals, financial institutions and personal computers worldwide and extorting millions of dollars. Ransomware is a type of malware that infects computers...

Paragon Initiative Enterprises: Not using Binary::safe* functions for substr/strlen function

Several places in the code don't use Binary::safe or CryptoUtil::safe functions, but use raw functions instead strlen/substr which can act as mbfuncname instead not count bytes for strlen/etc... 1...

Paragon Initiative Enterprises: Missing GIT tag/commit verification in Docker

in: https://github.com/paragonie/airship/blob/master/docker/Dockerfile.airshipL14-L16 RUN git clone https://github.com/jedisct1/libsodium.git /tmp/sodium WORKDIR /tmp/sodium RUN git checkout tags/1.0.10 The code is fetched from Github without one of: 1. signature verification on relevant tag. GPG...

Paragon Initiative Enterprises: DMARC Not found for paragonie.com URGENT

Hi sir, , I am new hacker in hackerone platform I am glad to join paragonie bounty program ..i want to report a very critical bug that is i found DMARC missing for your domain paragonie.com Add DMARC record as soon as possible .. DMARC description Background Email authentication technologies SPF...

Paragon Initiative Enterprises: [Airship CMS] Local File Inclusion - RST Parser

Airship uses the very useful RST Parser from Gregwar. However, the parser has the RST directive include built-in why it isn't a separate directive per the spec, I don't know. However, as a result, LFI is possible in Airship. I realize this isn't directly Paragonie's code, but since Airship uses...

moghalenterprises.com XSS vulnerability

Vulnerable URL: http://www.moghalenterprises.com/search.php Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 14790401 VIP website status:| No Check...

parkaenterprises.com XSS vulnerability

Vulnerable URL: http://www.parkaenterprises.com/search.php Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18883849 VIP website status:| No Check...

Huawei UMA Information Disclosure Vulnerability

Huawei UMA Unified Maintenance and Audit is a unified IT core resource operation and maintenance management and security audit platform designed for carriers, government, finance, electric power and large enterprises. Huawei UMA suffers from an information disclosure vulnerability that could be...

Unsealing the Deal: Cyber Threats to Mergers and Acquisitions Persist in a Hot Market

Risks Posed by Sensitive Corporate Communications, Broadened Attack Surface In 2015, a record $5 trillion dollars was tied up in mergers and acquisitions M&A deals, according to JP Morgan. So far, mega deals in 2016 include Microsoft’s purchase of LinkedIn, Shire’s acquisition of Baxalta, and...

SeaRainbow Enterprises (Holdings) Limited Food and Drug Administration Portal/interplugin/face2/content.jsp?tableId=Page with SQL Injection Vulnerability

The Food and Drug Administration Portal is a CMS system. Sea Rainbow Enterprises Holdings Limited Food and Drug Administration Portal /interplugin/face2/content.jsp?tableId=Page SQL injection vulnerability, an attacker can use the vulnerability to obtain data data...

Paragon Initiative Enterprises: Session Management Issue CMS Airship

Hey, I've found a session management issue in CMS Airship bridge.cspr.ng Issue ---------- When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce + We Need to use two broswers 1. Login to one browser 2. Login to second browser 3. Then change th...

Paragon Initiative Enterprises: Nginx Version Disclosure On Forbidden Page

Hi, PoC 1- Go that link you'll see the version of nginx server https://paragonie.com/static/highlightjs/...

Paragon Initiative Enterprises: Stored Cross-Site-Scripting in CMS Airship's authors profiles

I'm just checking out CMS Airship and some of the security features look pretty nice. Awesome job on that! After clicking around a bit I stumbled however upon a stored XSS vulnerability in the Bridge. As per /bridge/help I use 1.1.0 version installed via Docker, as I couldn't find any reference...

Paragon Initiative Enterprises: Full path disclosure vulnerability on paragonie.com

Sir, I have found a bug which is Full path discloser vulnerability. Vulnerable Point https://paragonie.com/contact my post data...

Paragon Initiative Enterprises: Vunerability : spf

Heĺlo sir, im an independent security researcher. I found an vunerability in your website Your website https://github.com/paragonie doesn't have valid spf records. To recover this do validate your spf. Sender Policy Framework SPF: This allows you specify which mail servers are allowed to send mai...