CVE-2018-8768

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous...

PT-2018-18623

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 5.4.1 Description A maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it...

Memcrashed-DDoS-Exploit - DDoS Attack Tool For Sending Forged UDP Packets To Vulnerable Memcached Servers Obtained Using Shodan API

This tool allows you to send forged UDP packets to Memcached servers obtained from Shodan.io Prerequisites The only thing you need installed is Python 3.x apt-get install python3 You also require to have Scapy and Shodan modules installed pip install scapy pip install shodan Using Shodan API This...

CVE-2018-8715

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types...

PYSEC-2018-46

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

Cisco Email Security Appliance and Cisco Content Security Management Appliance Information Disclosure Vulnerability

Cisco Email Security Appliance ESA and Cisco Content Security Management Appliance SMA are both products of Cisco USA.Cisco ESA is a set of email security appliances, which provides spam protection, email encryption, data loss protection and other functions. Cisco ESA is an email security applian...

CVE-2018-0146

A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to improper CSRF protection by the affected application. An attacker could...

Tejari Cross Site Request Forgery

----------------------------------------------------- Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: Tejari Affected Product Code Base: Bravo Solution Affected Component: Web Interface Management. Attack Type: Local - Authenticated Impact: Unauthorised Access...

CVE-2018-1000025

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

PT-2018-9216

Name of the Vulnerable Software and Affected Versions: Firebase Admin SDK for PHP versions 3.2.0 through 3.8.0 Description: The issue is related to an Incorrect Access Control vulnerability in the src/Firebase/Auth/IdTokenVerifier.php file, which does not verify token signatures. This can result ...

Mozilla Firefox Forged URL Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A spoofed URL vulnerability exists in Mozilla Firefox versions prior to 58 and Firefox ESR versio...

UBUNTU-CVE-2017-15090

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

FreeBSD : shibboleth-sp -- vulnerable to forged user attribute data (3dbe9492-f7b8-11e7-a12d-6cc21735f730)

Shibboleth consortium reports : Shibboleth SP software vulnerable to forged user attribute data The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type...

IBM Security Access Manager Open Redirect Vulnerability

IBM Security Access Manager is a product for information security management applications from IBM, USA. The product enables access management control through integrated devices for web, mobile and cloud computing. An open redirection vulnerability exists in IBM Security Access Manager. A remote...

CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

CVE-2017-9314

Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DHNVR5xxxEngPV2.616.0000.0.R.20171102. Attacker could exploit this vulnerability to gain access to additional operations by means of forging json message...

Huawei LON-L29D Denial of Service Vulnerability

Huawei LON-L29D is a smartphone from Huawei. The Huawei LON-L29D handset suffers from a denial of service vulnerability, which can be exploited successfully to cause the device to reset by sending a forged 3GPP message that causes the program to remain unable to exit the loop...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...

Circle with Disney SSL TLD Man-in-the-Middle Attack Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. An SSL TLD man-in-the-middle attack vulnerability exists in the remote control feature in Circle with Disney version 2.0.1. An attacker...