CVE-2016-10212: Exposure of Sensitive Information to an Unauthorized Actor

Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack," a similar issue to CVE-2016-0270. NOTE: this issue may be due to the use of a third-party Cavium product...

PT-2017-7809

Name of the Vulnerable Software and Affected Versions Radware devices affected versions not specified Description The issue allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack" due to the use of the same value for the first two GCM nonces. This is simil...

Cross site scripting

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...

UBUNTU-CVE-2013-7454

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...

CVE-2013-7454

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...

CVE-2013-7454

Removed by vendor...

CVE-2013-7454

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...

CVE-2013-7454: Improper Neutralization of Input During Web Page Generation

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via nested forbidden strings...

dirList 0.3.0 File Upload / Command Execution

Credits / Discovery: John Page + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DIRLIST-FILE-UPLOAD-BYPASS-CMD-EXEC.txt + ISR: Apparition + Vendor: =============== sourceforge.net Product: =============== dirList v0.3.0 Download: ===========...

Skyport Systems: Nginx version disclosure via forbidden page

This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact: An attacker might use the disclosed information to harvest specific security vulnerabilities for the version...

Error: "Cannot complete your request" while accessing on premise XenApp 7.9 Resources by a user from Azure Active Directory.

When users from Azure domain are trying to access resources published via XenApp 7.9 on your premise, they receive this error: "Cannot complete your request". On looking at the Storefront debug logs, you see that storefront does a Callback: 00001779 3:27:23 AM 8248 Authenticate Perform callback A...

Smart Card Authentication Fails with HTTP Error 403 Forbidden

...

Nextcloud: Content Injection - apps.nextcloud.com

Hi there, The following URL: https://apps.nextcloud.com/.htacess%20Content%20Injection%20test is vulnerable to Content Injection. Reference: https://www.owasp.org/index.php/ContentSpoofing You should use a 403 Forbidden page. If you need further information, let me know. Thanks!...

Roxy File Manager 1.4.4 Shell Upload

Exploit Title: Roxy Fileman = 1.4.4 Forbidden File Upload Vulnerability Google Dork: intitle:"Roxy file manager" Date: 15-06-2016 Exploit Author: Tyrell Sassen Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.4-php Version: 1.4.4 Tested on:...

Roxy Fileman 1.4.4 - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: Roxy Fileman = 1.4.4 Forbidden File Upload Vulnerability Google Dork: intitle:"Roxy file manager" Date: 15-06-2016 Exploit Author: Tyrell Sassen Vendor Homepage: http://www.roxyfileman.com/ Software Link:...

Roxy Fileman 1.4.4 - Arbitrary File Upload

Roxy Fileman 1.4.4 - Arbitrary File Upload Exploit Title: Roxy Fileman = 1.4.4 Forbidden File Upload Vulnerability Google Dork: intitle:"Roxy file manager" Date: 15-06-2016 Exploit Author: Tyrell Sassen Vendor Homepage: http://www.roxyfileman.com/ Software Link:...

Roxy Fileman 1.4.4 - Arbitrary File Upload

Exploit Title: Roxy Fileman = 1.4.4 Forbidden File Upload Vulnerability Google Dork: intitle:"Roxy file manager" Date: 15-06-2016 Exploit Author: Tyrell Sassen Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.4-php Version: 1.4.4 Tested on:...

Forbidden attack: 7 million web servers get caught by the attack of the risk-vulnerability warning-the black bar safety net

! Recently, according to some international safety panel research showed that financial giants Visa's part of the HTTPS protected site has recently been discovered a vulnerability, which can allow a hacker to inject malicious code, the visitor's browser will access to malicious content. Encryptio...

Bumble: AWS S3 Bucket hotornot-images permissions allow for listing and removing files

We do not use amazon AWS but @yaworsk wanted to disclose his report anyway. Why not, we can do. ---- Hi All, Though I'm not 100% sure you own the bucket - and if not, I would appreciate being able to close this myself - I believe you may own the S3 bucket hotornot-images. If so, using the AWS CLI...

My Forbidden Love -TRUE LOVE- - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application My Forbidden Love -TRUE LOVE- published at the 'play' market has multiple vulnerabilities...