PT-2019-13340

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.2 Description The issue allows remote attackers to cause a denial of service, resulting in continual focus grabs, by sending a sequence of invalid launch?action=join&confno= requests to localhost port 19421...

Command injection

VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668 listening for requests on localhost. Requests submitted to this service are checked for a string of random characters...

Path Traversal

Overview All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix...

PT-2019-9357

Name of the Vulnerable Software and Affected Versions VTech Storio Max version before 56.D3JM6 Description The issue allows remote command execution via shell metacharacters in an Android activity name. It exposes the storeintenttranslate.x service on port 1668, listening for requests on localhos...

Arido Instant Messenger has a flawed logic vulnerability

Yudu Instant Messenger is an enterprise-grade instant messaging platform. A logic flaw vulnerability exists in Yudu Instant Messenger. An attacker bypasses local detection by modifying the HOST header in the HTTP request packet to localhost, resulting in a remote reset of the administrator passwo...

Path Traversal in localhost-now

All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2 Proof of concept: $ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" Recommendation No f...

GHSA-73CW-JXMM-QPGH Path Traversal in localhost-now

All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2 Proof of concept: $ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" Recommendation No f...

PT-2019-20017

Name of the Vulnerable Software and Affected Versions localhost-now versions 1.0.2 and later Description The issue allows for path traversal, effectively bypassing the fix introduced in version 1.0.2. A proof of concept demonstrates this using a curl command to access the /etc/passwd file...

Free SMTP Server 2.5 Denial Of Service

Exploit Title: Free SMTP Server - Local Denial of Service Crash PoC Date: February 3, 2009 Exploit Author: Metin Kandemir kandemir Vendor Homepage: http://www.softstack.com/freesmtp.html Software Link: https://free-smtp-server.en.uptodown.com/windows/download Version: 2.5 Tested on: Windows 7...

WordPress Inkblot Theme 4.9.10 Cross Site Request Forgery

Exploit Title : WordPress Inkblot Themes 4.9.10 Cross Site Request Forgery Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 22/05/2019 Vendor Homepage : wordpress.org - gravityforms.com Software Download Link : github.com/mgsisk/inkblot/archive/master.zip Softwar...

CVE-2018-12301

Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost...

Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration PAC file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is...

Server side request forgery (ssrf)

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-7652

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

PT-2019-18683

Name of the Vulnerable Software and Affected Versions TheHive Project UnshortenLink analyzer versions prior to 1.1 Cortex-Analyzers versions prior to 1.15.2 Description The issue allows for Server-Side Request Forgery SSRF attacks. An attacker can exploit this by creating a new analysis, selectin...

Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration PAC file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is...

HumHub 1.3.12 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: HumHub 1.3.12 - Cross-Site Scripting Exploit Author: Kağan EĞLENCE Vendor Homepage: https://humhub.org/ Version: 1.3.12 CVE : CVE-2019-11564 Url :...

Ubiquiti Inc.: Privilege Escalation From user to SYSTEM via unauthenticated command execution

The vulnerability, or feature depending how you look at it, is the ability to execute commands using the evostream API interface that is exposed on localhost:7440. Since the evostream service is running as SYSTEM a user can use the launchprocess command,...

GitLab: GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery

Summary The GitLab::UrlBlocker IP address validation methods suffer from a Time of Check to Time of Use ToCToU vulnerability. The vulnerability occurs due to multiple DNS resolution requests performed before and after the checks. This issue allows a malicious authenticated user to send GET and PO...

MGASA-2019-0129 Updated thunderbird packages fix security vulnerability

Use-after-free when removing in-use DOM elements. CVE-2019-9790 Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey. CVE-2019-9791 IonMonkey leaks JSOPTIMIZEDOUT magic value to script. CVE-2019-9792 Improper bounds checks when Spectre mitigations are...