CVE-2018-6324

The CVE-2018-6324 issue affects F-Secure Radar (on-premises) prior to 2018-02-15, with an unvalidated Redirect via the ReturnUrl parameter that occurs after login. Impact described as an open redirect; user is redirected to a user-controlled destination, potentially leading to phishing or credent...

CVE-2018-6189

CVE-2018-6189 affects F-Secure Radar (on-premises) prior to 2018-02-15, enabling a cross-site scripting (XSS) vulnerability via the Tags parameter in the JSON body of an outbound request to /api/latest/vulnerabilityscans/tags/batch. The issue is described as a “suggested metadata tags for assets”...

F-Secure Radar Open Redirect

F-Secure Radar Login Page Unvalidated Redirect Vulnerability CVE-2018-6324 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6324 Summary The application will upon successfully logging in redirect the user to a user-controlled destination. A victim user may not recognise that a redirection take...

F-Secure Radar Cross Site Scripting

F-Secure Radar Persistent Cross-Site Scripting Vulnerability CVE-2018-6189 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6189 Summary The application can suggest metadata tags for assets, and in doing so it can execute JavaScript entered previously by a malicious user. Vendor Description...

f-fish.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-557026 Description| Value ---|--- Affected Website:| f-fish.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FiberHome AN5506 - Remote DNS Change

FiberHome AN5506 - Remote DNS Change FIBERHOME AN5506 Unauthenticated Remote DNS Change Vulnerability Software Version RP2617 Device Model AN5506-04-F Vendor Homepage: www.fiberhome.com/ Date: 01/02/2018 Exploit Author: r0ots3c http://wandoelmo.com.br https://www.facebook.com/wsec.info Descriptio...

Intel AMT Loophole Allows Hackers to Gain Control of Some PCs in Under a Minute

Researchers have found a loophole in Intel processors that allow an attacker to bypass logins and place backdoors on laptops, allowing adversaries remote access to laptops. Researchers at F-Secure, that first identified the attack strategy, say the loophole can be exploited in less than one minut...

f-academy.nl XSS vulnerability

Open Bug Bounty ID: OBB-455417 Description| Value ---|--- Affected Website:| f-academy.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FS IMDB Clone SQL Injection Vulnerability

FS IMDB Clone is a set of PHP-based scripts for online movie ticket booking websites. A SQL injection vulnerability exists in FS IMDB Clone version 1.0. The vulnerability can be exploited to inject SQL by sending the 'f' parameter to the movie.php file, the 's' parameter to the tvshow.php file, o...

Vulnerability Management for Network Perimeter

Network Perimeter is like a door to your organization. It is accessible to everyone and vulnerability exploitation does not require any human interactions, unlike, for example, phishing attacks. Potential attacker can automate most of his actions searching for an easy target. It's important not t...

f-channel.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-428645 Description| Value ---|--- Affected Website:| f-channel.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update C)

CVSS v3 6.8 Vendor: Siemens Equipment: SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products Vulnerabilities: Security Features UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was...

Bad Rabbit Ransomware Uses Leaked 'EternalRomance' NSA Exploit to Spread

A new widespread ransomware worm, known as "Bad Rabbit," that hit over 200 major organisations, primarily in Russia and Ukraine this week leverages a stolen NSA exploit released by the Shadow Brokers this April to spread across victims' networks. Earlier it was reported that this week's...

bulat.ru XSS vulnerability

Vulnerable URL: http://bulat.ru/forma/ Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2318490 VIP website status:| No Check bulat.ru SSL connection:| Grade: F Coordinated Disclosure Timeline: Description| Value...

newview-tattoosupply.com XSS vulnerability

Vulnerable URL: http://www.newview-tattoosupply.com/products.html?keywords=%3C%2Fscript%3E%22%3E%3Cscript%3Eprompt%22OPENBUGBOUNTY%22%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly...

drevistas.ucv.cl XSS vulnerability

Vulnerable URL: http://drevistas.ucv.cl/detallesnumero.php?tituloID=132=%22%3E%3Csvg%2Fonload%3Dalert%27OPENBUGBOUNTY%27%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

parentesis.com XSS vulnerability

Vulnerable URL: http://www.parentesis.com/noticias/Entretenimiento/" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 49213 VIP website status:| Yes Check parentesis.com SSL...

gogolistings.com XSS vulnerability

Vulnerable URL: http://www.gogolistings.com//?cityid=1〈=en="=50=ads Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 989552 VIP website status:| No Check gogolistings.com SSL...

etp.com.br XSS vulnerability

Vulnerable URL: http://www.etp.com.br/en/search.php?s=%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E\n Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

habitos.be Open Redirect vulnerability

Vulnerable URL: http://www.habitos.be/counterKC.aspx?iid=192=7=www.openbugbounty.org/\n Details: Description| Value ---|--- Patched:| No Latest check for patch:| 16.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 1599374 VIP website status:| No Che...