242 matches found
Exploit for Deserialization of Untrusted Data in Apache Ofbiz
CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in we...
Smart DNS: Delivering the Best Subscriber Experience
This is the second in a series of blog posts that discuss how smart DNS resolvers can enhance ongoing network transformation efforts such as the transition to 5G, better integration of Wi-Fi, and new network designs that optimize the edge to improve the subscriber experience, service delivery, an...
hit-bosch.nl Cross Site Scripting vulnerability OBB-1456201
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
hit-shop.kr Cross Site Scripting vulnerability OBB-1420821
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Acronis: Web cache poisoning at www.acronis.com
Summary I found the problem of cache poisoning in www.acronis.com. A poisoned web cache can potentially be a devastating means of distributing numerous different attacks, exploiting vulnerabilities such as XSS, JavaScript injection, open redirection, and so on. Steps To Reproduce 1. Use...
hit-shop.kr Cross Site Scripting vulnerability OBB-1396680
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Hackers Stole $5.4 Million From Eterbase Cryptocurrency Exchange
Cybercriminals successfully plundered another digital cryptocurrency exchange. European cryptocurrency exchange Eterbase this week disclosed a massive breach of its network by an unknown group of hackers who stole cryptocurrencies worth 5.4 million dollars. Eterbase, which has now entered...
The vulnerability of Coriant SURPASS HiT network equipment, related to errors in processing input data, allows a intruder to trigger a service failure.
The vulnerability of Coriant SURPASS HiT network equipment is related to errors in processing input data by the Ethernet interface. Exploiting this vulnerability can allow a malicious actor to trigger service failures by sending broadcast packets...
CVE-2020-3645: Reachable Assertion
Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...
Optimizing Video Streaming Performance with Origin-Assisted Prefetching
Online video streaming is everywhere today. It's available on the smallest hand-held devices to the largest of screens in our living rooms. Magically and for the most part, it works and provides a very captivating experience. However, if you step back to look at the overall architecture, media...
PT-2019-5530
Name of the Vulnerable Software and Affected Versions Coriant SURPASS HiT affected versions not specified Description The issue is related to errors in processing input data by the Ethernet board, which can be exploited by a remote attacker to cause a denial of service by sending broadcast packet...
WordPress VeronaLabs wp-statistics plugin SQL Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.VeronaLabs wp-statistics plugin is a website statistics plugin used in it. A SQL injection vulnerability exists in the v1/hi...
CVE-2019-13275
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...
CVE-2019-13275: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...
PT-2019-13229
Name of the Vulnerable Software and Affected Versions VeronaLabs wp-statistics plugin versions prior to 12.6.7 Description An issue was discovered in the plugin, where the "v1/hit" endpoint of the API is vulnerable to unauthenticated blind SQL Injection when the non-default "use cache plugin"...
hit-parade.com XSS vulnerability
Open Bug Bounty ID: OBB-700418 Description| Value ---|--- Affected Website:| hit-parade.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...
req.hit-parade.com XSS vulnerability
Open Bug Bounty ID: OBB-700414 Description| Value ---|--- Affected Website:| req.hit-parade.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...
hit-keller.de XSS vulnerability
Open Bug Bounty ID: OBB-596431 Description| Value ---|--- Affected Website:| hit-keller.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Spectre and Meltdown Attacks
After a week or so of rumors, everyone is now reporting about the Spectre and Meltdown attacks against pretty much every modern processor out there. These are side-channel attacks where one process can spy on other processes. They affect computers where an untrusted browser window can execute cod...
The Forrester Wave Ranks Imperva as a Leader for DDoS Mitigation Providers
Imperva has tracked the DDoS threat for some time now. Back in 2014 we saw the rise of DDoS botnets. In 2015, we revealed one of the first IoT-based DDoS attacks. Last year, we predicted and then documented one of the largest botnet-based DDoS attacks. DDoS mitigation, as it turns out, is the...