Denial Of Service (DoS)

github.com/kubernetes/kubernetes is vulnerable to denial of service. A remote attacker is able to crash the application via a malicious request to the unauthenticated HTTP read-only API that is typically served on port 10255, and the authenticated HTTPS API typically served on port 10250...

fcnetwork.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1123653 Security Researcher securaji Helped patch 77 vulnerabilities Received 3 Coordinated Disclosure badges Received 4 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting fcnetwork.com website and it...

Security Bulletin: A security vulnerability has been identified in Tivoli Netcool/OMNIbus WebGUI shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4197)

Summary Tivoli Netcool/OMNIbus WebGUI is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting Tivoli Netcool/OMNIbus WebGUI has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss...

HTTPS Everywhere - A Browser Extension That Encrypts Your Communications With Many Websites That Offer HTTPS But Still Allow Unencrypted Connections

A browser extension that encrypts your communications with many websites that offer HTTPS but still allow unencrypted connections. Getting Started Get the packages you need and install a git hook to run tests before push: bash install-dev-dependencies.sh Run the ruleset validations and browser...

name.com Cross Site Scripting vulnerability

Security Researcher shivprsadsammbhare Helped patch 450 vulnerabilities Received 3 Coordinated Disclosure badges Received 5 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting name.com website and its users. Following...

Internet Bug Bounty: Cache Poisoning

Summary: An attacker can cause Squid to return to the user attacker controlled data, for any domain. From Squid-4.7 and below both HTTPS and FTP could be poisoned. This is due to Squid URL decoding parts of the Request URL and using that to create a hash. Request that decode to the same URL will...

SUSE SLES12 Security Update : ovmf (SUSE-SU-2020:0699-1)

This update for ovmf fixes the following issues : Security issues fixed : CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. CVE-2019-14559: Fixed a...

damas.net Cross Site Scripting vulnerability

Security Researcher ianf0ns3c Helped patch 25 vulnerabilities Received 1 Coordinated Disclosure badges Received 3 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting damas.net website and its users. Following coordinated and...

Rconfig 3.x Chained Remote Code Execution Exploit

This Metasploit module takes advantage of a command injection vulnerability in the path parameter of the ajax archive file functionality within the rConfig web interface in order to execute the payload. Valid credentials for a user with administrative privileges are required . However, this modul...

Rconfig 3.x - Chained Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rconfig 3.x Chained Remote Code Execution', 'Description' = ' This module exploits multiple vulnerabilities in rConfig version 3.9 in order to...

SUSE-SU-2020:0699-1 Security update for ovmf

This update for ovmf fixes the following issues: Security issues fixed: - CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation bsc1163959. - CVE-2019-14553: Fixed the TLS certification verification in HTTPS-over-IPv6 boot sequences bsc1153072. - CVE-2019-14559: Fixe...

Rconfig 3.x Chained Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Rconfig 3.x Chained Remote Code Execution', 'Description' = ' This module exploits multiple vulnerabilities in rConfig version 3.9 in order to...

CVE-2019-5160

An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized...

Input validation

An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized...

Microsoft Visual Studio Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL. An attacker who successfully exploited this vulnerability could compromise the access tokens, exposing security and privacy risks. To exploit this vulnerability, an attacker would nee...

PT-2020-11083

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912 Description An improper host validation issue exists in the Cloud Connectivity functionality, allowing a specially crafted HTTPS POST request to cause the software to connect...

CVE-2020-8987

Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow...

CVE-2020-8987

The CVE-2020-8987 issue affects Avast AntiTrack (before 1.5.1.172) and AVG Antitrack (before 2.0.0.178). The root problem is that these products proxy HTTPS traffic but do not validate certificates, allowing a man-in-the-middle to host a malicious site using a self-signed certificate. This risk i...

CVE-2020-8987: Improper Certificate Validation

Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow...

PT-2020-20410

Name of the Vulnerable Software and Affected Versions Avast AntiTrack versions prior to 1.5.1.172 AVG Antitrack versions prior to 2.0.0.178 Description The issue allows a man-in-the-middle to host a malicious website using a self-signed certificate, as the software does not validate certificates...