Acronis: Account Confirmation bypass leads to acess some fucntionality

STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...

CVE-2021-25347

Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed...

Security feature bypass

Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed...

CVE-2021-25347

CVE-2021-25347 affects the Samsung Email application. A hijacking vulnerability in versions prior to the SMR Feb-2021 Release 1 could allow an attacker to intercept when the provider is executed. The available documents consistently describe interception as the impact, but do not provide detailed...

CVE-2021-25347

Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed...

The vulnerability of the OpenSSL library lies in its insufficient encryption strength, which allows attackers to intercept all encrypted messages sent over a TLS connection.

The vulnerability of the OpenSSL library is related to insufficient encryption strength. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept all encrypted messages sent through the TLS connection...

Online Voting System 1.0 Authorization Bypass

Exploit Title:Online Voting System | Authentication Bypass Password Change Exploit Author: Richard Jones Date: 2021-01-29 Vendor Homepage: https://www.sourcecodester.com/php/14690/online-voting-system-phpmysqli-full-source-code.html Software...

Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been

The Mozilla Foundation Security Advisory describes this flaw as: When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to...

Man-in-the-Middle (MitM)

github.com/kubernetes/kubernetes is vulnerable to man-in-the-middle attacks. An attacker is able to intercept and modify traffic other pods or nodes in the cluster if there is permission to create or edit services and pods...

CVE-2020-8554

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status which is considered a privileged operation and should not...

CVE-2020-8554

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status which is considered a privileged operation and should not...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

h1-ctf: Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]

Hello Team Description In the continuous series of 12 days, twelve flags were hidden inside Hackyholidays site - hackyholidays.h1ctf.com in which once we get all the flags, grinch can be stopped. This write-up will describe solving all the 12 days challenges. Step To Reproduce + It all started wh...

CVE-2020-28912

With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...

CVE-2020-28190

TerraMaster TOS = 4.2.06 was found to check for updates of both system and applications via an insecure channel HTTP. Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

The vulnerability of the Fanuc 32i numerical program-controlled controller, related to the transmission of data in an open manner, allows a intruder to intercept control data and enhance their privileges.

The vulnerability of the Fanuc 32i numerical control controller lies in the transfer of data in an open manner. Exploiting this vulnerability can allow a intruder to intercept the control commands and enhance their privileges...

The vulnerability of the CmtViewer application, which involves session management errors, allows a hacker to gain unauthorized access.

The vulnerability of the CmtViewer application for controlling programmable panels is related to session management errors. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access by intercepting the session...

Improper Validation Of Certificate

rsync is vulnerable to improper validation of certificate. It does not verify the hostname in the server certificate in openssl mode, so a man-in-the-middle attacker with a valid certificate for another hostname could intercept connections...

U.S. Dept Of Defense: Full account takeover in ███████ due lack of rate limiting in forgot password

Steps: 1. Visit the link https://www.██████/██████████and enter the valid ████████. 2. You will be redirect to the page where it will ask you to fill your ████████ and ████████ that you get in your mail. 3. Enter the wrong ███ and intercept the request. 4. Then bruteforce the ███.You can use burp...