Sifchain: Subdomain Takeover on proxies.sifchain.finance pointing to vercel

Hello Team, Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that subdomain...

Remote Code Execution (RCE)

October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of PHP code int he template markup allowing an attacker with "create, modify and delete website pages" privileges to inject maliciously crafted PHP code...

Cisco IOS XE Software 安全漏洞

Cisco IOS XE Software is an operating system from the U.S. company Cisco Cisco. Used as a single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity.An access control error vulnerability exists in Cisco IOS XE...

Design/Logic Flaw

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points...

LINE for Windows 代码问题漏洞

LINE for Windows is a Windows-based instant messaging application from Japanese company LINE. A security vulnerability exists in LINE for Windows 6.2.1.2289 and earlier, which allows execution of arbitrary code via injection from a malicious DLL...

Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp

✍️ Description Reflected XSS in changebranch.php where due to improper implementation of code an attacker is able to inject malicious tags 🕵️‍♂️ Proof of Concept $branch = escapeshellcmd$GET'branch'; $command = "sudo /opt/fpp/scripts/gitbranch " . $branch . " 2&1"; echo "Command: $command\n";...

CVE-2020-7697

This affects all versions of package mock2easy. a malicious user could inject commands through the data variable: Affected Area require'../server/getJsonByCurl'mock2easy, function error, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , '', data.interfaceUrl, query,...

Credit card skimmer targets ASP.NET sites

Update: 2020-07-09 A reader contacted us with information about this series of attacks on .NET sites. There is a known vulnerability CVE-2017-9248 for Telerik UI for ASP.NET that is being exploited. An attacker can upload .aspx web shells and get remote code execution. This Telerik page offers...

Cross-site Scripting (XSS)

markdown-to-jsx is vulnerable to cross-site scripting XSS attacks. The library does not properly convert tag names to lowercase before evaluating against the blacklist, allowing a malicious user to inject script and style tags by using uppercase letters...

Two Zoom Zero-Day Flaws Uncovered

UPDATE Two zero-day flaws have been uncovered in Zoom’s macOS client version, according to researchers. The web conferencing platform vulnerabilities could give local, unprivileged attackers root privileges, and allow them to access victims’ microphone and camera. As of Thursday, the two...

PT-2020-1795 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to a cross-site scripting XSS vulnerability. This occurs when Microsoft Exchange Server fails to properly sanitize a specially crafted web request,...

AUO SunVeillance Monitoring System 1.1.9e - MailAdd SQL Injection

AUO SunVeillance Monitoring System 1.1.9e - MailAdd SQL Injection Exploit Title: AUO SunVeillance Monitoring System 1.1.9e - 'MailAdd' SQL Injection Date: 2019-10-24 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO SunVeillance Monitoring System all versions prio...

KLA11568 DoS vulnerability in Wireshark

Unspecified vulnerability was found in Wireshark. Malicious users can exploit this vulnerability via injecting a malformed packet to cause denial of service. Original advisories wnpa-sec-2019-19 Related products Wireshark CVE list CVE-2019-12295 warning Solution Update to latest version Get...

Node.js third-party modules: [takeapeek] XSS via HTML tag injection in directory lisiting page

I was taking a peek at takeapeek module and found it is vulnerable to XSS via malicious injection in directory listing. It allows execution of arbitrary JS code. Module module name: takeapeek version: 0.2.2 npm page: https://www.npmjs.com/package/takeapeek Module Description A simple static...

Microsoft SharePoint Enterprise Server Privilege Access Control Vulnerability

Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A...

Remote Code Execution (RCE)

mobile-icon-resizer is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Microsoft Internet Information Server (IIS) Web Cross-Site Scripting Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. IIS Server is one of the basic Internet services running on it. A cross-site scripting vulnerability exists in IIS Server in Microsoft Windows. A remote attacker can exploit this vulnerability to read...

CVE-2016-8999

IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS...

NRPE 2.15 - Remote Command Execution

NRPE 2.15 - Remote Command Execution ============================================= - Release date: 17.04.2014 - Discovered by: Dawid Golunski - Severity: High ============================================= I. VULNERABILITY ------------------------- NRPE - Nagios Remote Plugin Executor = 2.15 Remot...

PHPFox v3.4.1 XSS vulnerabilities

Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account, impersonating the user. It is also possible to modify the content of the page...