DamiCMS Elevation of Privilege Vulnerability

DamiCMS is a content management system CMS for building websites quickly. A full-down elevation vulnerability exists in DamiCMS version 6.0.1, which stems from the program's reliance on the 'PHP time' function to generate cookies, and can be exploited to gain administrator privileges by making a...

Attack on Pseudo-random number generator (PRNG) used in 1000 Guess, an Ethereum lottery game. (CVE-2018–12454)

Abstract An Ethereum lottery game, 1000 Guess, has a vulnerability that it generates random numbers predictable by anyone. This game decides a winner by a random number when the number of players who bet on the contract reaches to the predetermined number. The contract generates the random number...

1000 Guess has an unspecified vulnerability

1000 Guess is an ethereum-based random number guessing game. A security vulnerability in the 'addguess' function of the implementation of the simplelottery smart contract in 1000 Guess stems from the program's use of publicly readable variables to generate random values. An attacker could exploit...

CVE-2016-10535

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses "===", a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

CVE-2016-10535: Observable Timing Discrepancy

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

DEBIAN-CVE-2018-10767

There is a stack-based buffer over-read in calling GLib in the function gxpsimagesguesscontenttype of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a ginputstreamread call. A crafted input will lead to a remote denial of service attack...

CVE-2018-7195: Undefined Security Weakness

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords when an associated e-mail address is known by leveraging guest access and guessing a 6-digit number...

Protobuf-Inspector - Tool To Reverse-Engineer Protocol Buffers With Unknown Definition

Simple program that can parse Google Protobuf encoded blobs version 2 or 3 without knowing their accompanying definition. It will print a nice, colored representation of their contents. Example: As you can see, the field names are obviously lost, together with some high-level details such as:...

Monero: Corrupt RPC responses from remote daemon nodes can lead to transaction tracing

Dear Monero security team, We’re writing to disclose a privacy vulnerability when using monero-cli or monero-gui with an untrusted remote node. When using a remote node, the Monero client relies on the node to provide information from the blockchain, in particular the public keys and transaction...

CVE-2017-17877

An issue was discovered in Valve Steam Link build 643. When the SSH daemon is enabled for local development, the device is publicly available via IPv6 TCP port 22 over the internet with stateless address autoconfiguration by default, which makes it easier for remote attackers to obtain access by...

accessories.guess.eu XSS vulnerability

Vulnerable URL: https://accessories.guess.eu/forgotpassword.php? Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

xguest weak password vulnerability

xguest is an account creation component for Linux systems. A weak password vulnerability exists in xguest that stems from the program using an insecure password. An attacker could exploit this vulnerability to guess the password...

Guess the Dress (app for kids) - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Guess the Dress app for kids published at the 'play' market has multiple vulnerabilities...

Guess That Celebrity 2 - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess That Celebrity 2 published at the 'play' market has multiple vulnerabilities...

Guess the word by 4 pics - Base64 encoded String, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess the word by 4 pics published at the 'play' market has multiple vulnerabilities...

Guess Picture - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess Picture published at the 'play' market has multiple vulnerabilities...

New PLL Guess Words - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application New PLL Guess Words published at the 'play' market has multiple vulnerabilities...

Guess The Song: 4 Pics 1 Song - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess The Song: 4 Pics 1 Song published at the 'play' market has multiple vulnerabilities...

Guess The Word: 4 Pics 1 Word - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess The Word: 4 Pics 1 Word published at the 'play' market has multiple vulnerabilities...

Guess the Brand! - Logo Quiz - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Guess the Brand! - Logo Quiz published at the 'play' market has multiple vulnerabilities...