bw.rocktwp.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-955365 Security Researcher Gh05tPT Helped patch 6884 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting bw.rocktwp.net website an...

Cisco IronPort C150 Header Injection

!/usr/bin/perl -w Cisco IronPort C150 Remote Header 'Host' Injection Copyright 2019 c Todor Donev Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that Todor Donev is not liable for any...

Design/Logic Flaw

The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service DoS by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time...

Scientific Linux Security Update : python-requests on SL7.x x86_64 (20190806)

Security Fixes : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128255; scriptversion"1.5";...

Default credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

CVE-2019-15497 affects Black Box iCOMPEL 9.2.3 through 11.1.4 (as used in ONELAN Net-Top-Box 9.2.3–11.1.4 and other products). The root cause described is default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP . Impact is consistent with the NVD m...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

Design/Logic Flaw

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

The CVE-2016-10932 issue affects the hyper crate for Rust on Windows before version 0.9.4, where hostname verification was omitted during HTTPS, enabling potential Man‑in‑the‑Middle (MitM) attacks. Root cause: missing hostname verification in TLS on Windows builds. Impact: interception or tamperi...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2016-10932

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

PT-2019-14225

Name of the Vulnerable Software and Affected Versions Black Box iCOMPEL versions 9.2.3 through 11.1.4 ONELAN Net-Top-Box versions 9.2.3 through 11.1.4 Description The issue allows remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP due to default credentials. Recommendations...

CVE-2019-12527: the Squid buffer overflow resulting in remote code execution vulnerability alerts-a vulnerability alert-the black bar safety net

0x00 vulnerability background 2019 8 November 22, Trend Micro research team published a number of CVE-2019-12527 Squid proxy server buffer overflow vulnerability analysis report, the attacker in without authentication in the case of construction of a data package to exploit this vulnerability...

CVE-2016-10932: Undefined Security Weakness

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted...

CVE-2019-15497: Use of Hard-coded Credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

copel.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-951857 Security Researcher BoscoBecker Helped patch 3 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting copel.com website and its users. Following coordinated...

Google, Mozilla, Apple Block Kazakhstan's Root CA Certificate to Prevent Spying

In a move to protect its users based in Kazakhstan from government surveillance, Google, Apple and Mozilla finally today came forward and blocked Kazakhstan's government-issued root CA certificate within their respective web browsing software. Starting today, Chrome, Safari and Firefox users in...

goDoH - A DNS-over-HTTPS C2

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium. Currently supported providers include Google, Cloudflare but also contains the ability to use traditional DNS. Installation All you would need are the godoh binaries...