Informatica: XXE through injection of a payload in the XMP metadata of a JPEG file

Users are able to change their avatar picture. The avatar picture upload functionality is prone to a XXE attack when parsing the image file. Specifically, the XXE attack is executed through the injection of a payload in the "XMP metadata" of the uploaded JPEG file. Proof of concept note the "Burp...

Informatica: RXSS in http://procurement-businesscatalog.informatica.com

Hi, this is a simple XSS in the host below: Reproduction Steps Visit the following URL: http://procurement-businesscatalog.informatica.com/JPBC/login.hbc?lang=%3C/SCRIPT%3E%3CSCRIPT%3Ealertdocument.domain;%3C/SCRIPT%3E F760997 Impact Standard XSS impact...

Informatica: accounts.informatica.com - RCE due to exposed Groovy console

Researcher identified a misconfigured "Groovy" panel on an AEM web application that was vulnerable to RCE. The panel was subsequently disabled...

Informatica: Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker Access

Researcher has identified and reported public github repo leaking internal information...

WordPress Satoshi 2.0 Cross Site Request Forgery / File Upload

Exploit Title : WordPress Satoshi Themes 2.0 CSRF Arbitrary File Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 05/06/2019 Vendor Homepage : vooshthemes.com - tecnoge.com - netsons.com WordPress Affected Versions : 4.7.13 - 3.4.2 Theme Affected Version :...

Informatica: Cisco RCE

The researcher was able to complete RCE attack and download sensitive files. We have mitigated it by hardening the machine and port. There are opened classical cisco smart install service, which was successfully exploited. Informatica is a fAsTeSt!!! bug fixer in my life. Closing vulnerability in...

Informatica: SSRF on infawiki.informatica.com and infawikitest.informatica.com

Researcher has identified and reported SSRF on Informatica's Sub-domain and helped us in resolving the issue...

Informatica: [https://life.informatica.com] - information disclose

Researcher had discovered and reported an issues that leads to information disclosure...

Informatica: [http://www.informatica.com]- info disclosure

Researcher has identified and reported an sensitive information leakage in one of our domain. He helped us in resolving the issue...

eagleinformatica.com.ar XSS vulnerability

Open Bug Bounty ID: OBB-465664 Description| Value ---|--- Affected Website:| eagleinformatica.com.ar Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Informatica: [marketplace.informatica.com] - Template Injection

The researcher has identified and reported a "Template Injection" vulnerability in one of Informatica's domain and helped us in resolving the issue...

Informatica: [marketplace.informatica.com] - Stored XSS

The researcher has identified and reported a Stored XSS in Informatica website and helped us in resolving the issue...

Informatica: [marketplace.informatica.com] - Sensitive Data Exposure

The researcher has identified and reported a Sensitive Data Exposure vulnerability in one of the Informatica's domain, and helped us in resolving the issue...

Informatica: Reflected XSS

Researcher has found Reflected XSS on one of the Informatica's domain, and was resolved by migration of the web application...

Informatica: [marketplace.informatica.com]-Reflected XSS

The researcher has identified and reported a Reflected XSS in Informatica website and helped us in resolving the issue...

Analisi dei dump di Rousseau (Movimento Cinque Stelle) - Parte I: password

Disclaimer Questo blog post e' scritto da evariste.gal0is ed Antonio Sanso. Entrambi gli autori non hanno nessuna affiliazione politica ed il post ha l'unico scopo di fornire un'analisi tecnica di parte dei dump relativa alle password. Riassunto delle puntate precedenti In data 2 agosto 2017 uno...

Informatica: Unrestricted file upload - cloudacademy.informatica.com

Researcher had reported an "Unrestricted file upload" in one of our domain and helped us in mitigating the issue...

Informatica: [doc.rt.informaticacloud.com] Arbitrary File Reading via Double URL Encode

Hi. Attacker can read arbitrary file in system via next query: http://doc.rt.informaticacloud.com/infocenter/ActiveVOS/v92/topic/com.activee.bpep.doc/images/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd You can see the response here: F188500 root:x:0:0:root:/root:/bin/bash...

Informatica: [doc.rt.informaticacloud.com] Reflected XSS via Stack Strace

Hello. PoC for reflected XSS: http://doc.rt.informaticacloud.com/infocenter/ActiveVOS/v92/nav/712321 Response: HTTP ERROR 500 Problem accessing /help/nav/712321%3Csvg/onload=alertdocument.domain%3E. Reason: For input string: "1svg/onload=alertdocument.domain"Caused...

Informatica: [marketplace.informatica.com] User email disclosure

Researcher has identified a vulnerability in one of our domain "marketplace.informatica.com" where anyone can see email ID of any user which is marked as "private"...