kadolijst.nl Open Redirect vulnerability

Open Bug Bounty ID: OBB-487399 Description| Value ---|--- Affected Website:| kadolijst.nl Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Disclosure Standard:| Coordinated Disclosure based on ISO 291...

Atmail 7.1.1 PRO Cross Site Scripting

============================================================================ | Title : Atmail v7.1.1 PRO XSS Vulnerability | | Author : indoushka | | email : [email protected] | | Tested on : windows 10 FranASSais V.Pro | | Version : v7.1.1 | | Vendor : www.p30vel.ir | | Dork : Powered by...

Cross-Platform Post-Exploitation HTTP/2 Command & Control Server: Merlin

Merlin is a cross-platform post-exploitation framework that leverages HTTP/2 communications to evade inspection. HTTP/2 is a relatively new protocol that requests Perfect Forward Secrecy PFS encryption cipher suites are used. The use of these cipher suites makes it incredibly difficult to capture...

F5 Networks BIG-IP : BIG-IP SSL vulnerability (K21905460) (ROBOT)

On BIG-IP versions 11.6.0-11.6.2 fixed in 11.6.2 HF1, 12.0.0-12.1.2 HF1 fixed in 12.1.2 HF2, or 13.0.0-13.0.0 HF2 fixed in 13.0.0 HF3 a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when...

We need to talk about Session Tickets

More specifically, TLS 1.2 Session Tickets. Session Tickets, specified in RFC 5077, are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips. Unfortunately, a combination of deployment realities and...

We need to talk about Session Tickets

More specifically, TLS 1.2 Session Tickets. Session Tickets, specified in RFC 5077, are a technique to resume TLS sessions by storing key material encrypted on the clients. In TLS 1.2 they speed up the handshake from two to one round-trips. Unfortunately, a combination of deployment realities and...

PT-2017-13595 · Xiph.Org +3 · Libvorbis +3

Name of the Vulnerable Software and Affected Versions: libvorbis version 1.3.5 Description: An out-of-bounds array read issue exists in the function mapping0 forward in mapping0.c. This may lead to a denial of service DoS when operating on a crafted audio file with vorbis analysis. Recommendation...

CVE-2017-6147

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

Design/Logic Flaw

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

CVE-2017-6147

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM to restart, causing an interruption of service when "SSL Forward Proxy" setting is enabled in both the Client and Server SSL profiles...

CVE-2017-6147

CVE-2017-6147 affects F5 BIG-IP products (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe, and others) where enabling SSL Forward Proxy on both Client and Server SSL profiles can cause TMM to restart and interrupt traffic. The F5 advisory K43945001 lists multiple vulnerable...

F5 Networks BIG-IP : F5 TMM vulnerability (K43945001)

An undisclosed type of responses may cause TMM to restart, causing an interruption of service when 'SSL Forward Proxy' setting is enabled in both the Client and Server SSL profiles assigned to a BIG-IP Virtual Server. CVE-2017-6147 Impact If the SSL Forward Proxy option is enabled on both the...

Mail.ru: XSS when replying / forwarding to a malicious email on iOS

Domain, site, application -- Mail.ru for iOS Testing environment -- iOS 10 Steps to reproduce -- 1 Send you a mail with something like this in the From field: =?utf-8?b?PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+?=@pwnsdx.pw Note: This is a base64 string of "alertdocument.cookie" 2 Try t...

The vulnerability of the Oniguruma library, which arises from the use of an uninitialized variable, allows a hacker to perform read operations beyond the buffer boundary in dynamic memory.

The vulnerability of the Oniguruma library exists due to incorrect processing of reg-dmin in the forwardsearchrange function. This allows the use of an uninitialized variable during data reading from the buffer. Exploiting this vulnerability could enable a malicious actor to read beyond the...

Improper access control

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface of an affected device to the administrative management interface of an affected device, aka an Access Control Bypa...

SSL Labs Grading Redesign (Preview 1)

We’re excited to share with you the first preview of our next-generation grading. This is something that’s long overdue but, due to lack of available time, we managed to keep up patching the first-generation grading to keep up with the times. Now, finally, we’re taking the next necessary steps to...

ProtonMail Launches Free VPN Service

Encrypted email service ProtonMail announced today it was launching a free VPN service called ProtonVPN. Developers said the move comes following one year of development and four months of beta testing by 10,000 ProtonMail community members. According to Proton Technologies AG, the company behind...

DEBIAN-CVE-2017-9227

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbcenclen during regular expression searching. Invalid handling of reg-dmin in forwardsearchrange could result in an invalid pointer...

Meterpreter Session Proxy: Metasploit Aggregator

Meterpreter Session Proxy The Metasploit Aggregator is a proxy for Meterpreter sessions. Normally, Meterpreter sessions connect directly to a Metasploit listener. However, this has a few problems: 1. Multiple users cannot easily share the session once it is established, without some sort of...

CVE-2016-4838

The Android Apps Money Forward prior to v7.18.0, Money Forward for The Gunma Bank prior to v1.2.0, Money Forward for SHIGA BANK prior to v1.2.0, Money Forward for SHIZUOKA BANK prior to v1.4.0, Money Forward for SBI Sumishin Net Bank prior to v1.6.0, Money Forward for Tokai Tokyo Securities prior...