1431 matches found
Sql injection
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...
CVE-2021-3025
Summary: CVE-2021-3025 affects Invision Community IPS Community Suite up to version 4.5.4.2. The vulnerability is an SQL Injection in the Downloads REST API, triggered by the sortDir parameter via sortBy=popular in the GETindex() method of /applications/downloads/api/files.php. The issue could al...
CVE-2021-3025
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API the sortDir parameter in a sortBy=popular action to the GETindex method in applications/downloads/api/files.php...
IPS Community Suite Cross-Site Scripting Vulnerability
IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...
IPS Community Suite 4.5.4 SQL Injection
----------------------------------------------------------------------------- IPS Community Suite sortBy == 'popular' 56. 57. \IPS\Request::i-sortDir = \IPS\Request::i-sortDir ?: 'ASC'; 58. $sortBy = 'filerating ' . \IPS\Request::i-sortDir . ', filereviews'; 59. $where = array array 'filerating?'...
CVE-2021-3026
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...
CVE-2021-3026
CVE-2021-3026 affects Invision Community IPS Community Suite prior to 4.5.4.2 and enables cross-site scripting during the quoting of a post or comment. The issue is described as XSS in the quoting workflow, with multiple external records corroborating the vulnerability. The provided documents do ...
LiteSpeed Cache < 3.6.1 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise invalid IPs given in its Toolbox page before displaying them in an error message. Submit a payload such as in the Admin IPs section of the Toolbox /wp-admin/admin.php?page=litespeed-toolbox...
LiteSpeed Cache < 3.6.1 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise invalid IPs given in its Toolbox page before displaying them in an error message. PoC Submit a payload such as in the Admin IPs section of the Toolbox /wp-admin/admin.php?page=litespeed-toolbox...
Protect
An improper neutralization of input vulnerability in the FortiGate may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...
Hackers leak login credentials of vulnerable Fortinet SSL VPNs
By Sudais Asif A hacker using the alias "pumpedkicks" has published a large list of one-line exploits of around 50,000 Fortinet FortiGate IPs. Find out what happened. This is a post from HackRead.com Read the original post: Hackers leak login credentials of vulnerable Fortinet SSL VPNs...
CVE-2019-19781 - Verification Tool
Objective The Check-CVE-2019-19781 tool will enable customers to identify AAA and Gateway endpoints on Citrix ADC and Citrix Gateway devices in their deployment that are vulnerable to CVE-2019-19781. Customers are also encouraged to run the tool upon application of the mitigation steps to ensure...
Exploit for CVE-2020-14882
CVE-2020-14882 checker CVE-2020-14882 detection script This...
Taken - Takeover AWS Ips And Have A Working POC For Subdomain Takeover
Takeover AWS ips and have a working POC for Subdomain Takeover. Idea is simple Get subdomains. Do reverse lookups to only save AWS ips. Restart EC2 instance every min. and public ip gets rotated on each restart. Match it with your existing list of subdomain ips and you have a working subdomain...
PSA: Increase in RDP Attacks Means It's Time to Mind Your RDPs and Qs
This week, Rapid7 Managed Detection and Response’s MDR intrepid investigators identified an increase in RDP attacks targeting RDP servers without multi-factor authentication enabled. Given that a fair number of folks are still working remotely, it’s no wonder that attackers continue to seek out a...
DDoS Attacks Grow More Sophisticated as Imperva Mitigates Largest Attack
Only a few months ago Imperva reported mitigating against two of the largest DDoS attacks of 2020. However, in the past few weeks we’ve observed a rise in the number of DDoS attacks against our customers where both the volume of attacks and their level of intensity have increased significantly. O...
CVE-2020-12818
An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed...
Dnxfirewall - A Pure Python Next Generation Firewall Built On Top Of Linux Kernel/Netfilter
DNX Firewall is an optimized/high performance collection of applications or services to convert a standard linux system into a zone based next generation firewall. All software is designed to run in conjunction with eachother, but with a modular design certain aspects can be completely removed wi...
HTTP-revshell - Powershell Reverse Shell Using HTTP/S Protocol With AMSI Bypass And Proxy Aware
HTTP-revshell is a tool focused on redteam exercises and pentesters. This tool provides a reverse connection through the http/s protocol. It use a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS and AV. Help server.py unisessio...
