Gratipay: HTTP trace method is enabled on gip.rocks

Hello, HTTP TRACE method is enabled on your server which should not be enabled. It can lead to cross site tracing ! Cross site tracing: https://www.owasp.org/index.php/CrossSiteTracing curl -X TRACE http://gip.rocks/ -vv Hostname was NOT found in DNS cache Trying 184.73.218.93... Connected to...

Design/Logic Flaw

EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS12 file to the toolkit and...

CVE-2016-8217

EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS12 file to the toolkit and...

CVE-2017-2613

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records SECURITY-406...

Caregiver Script 2.57 SQL Injection

Exploit Title: Caregiver Script v2.57 a SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/caregiver-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview...

Facebook Tackles Account Recovery with Delegated Recovery Protocol

Account recovery, the second fiddle to authentication, still largely hinges on insecure schemes such as security questions or email-based verification for password resets and the like. Facebook today at the Enigma Conference in Oakland, Calif., offered a more modern solution called Delegated...

Caregiver Script 2.57 - SQL Injection

Exploit Title: Caregiver Script v2.57 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/caregiver-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview...

CVE-2017-3241

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with...

Maian Weblog 4.0 - SQL Injection

Maian Weblog 4.0 - SQL Injection Introduction Exploit Title: Maian Weblog – SQL Injection Date: 27.01.2017 Vendor Homepage: http://www.maianweblog.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview Simple blog system...

UBUNTU-CVE-2017-5008

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML pag...

USN-3179-1: OpenJDK 8 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

Complain Management System SQL Injection

Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802)

It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

Published app does not launch when SSO is used. Desktops launch fine.

Using Receiver and Receiver for web, published app wont launch but a published desktop works fine. If user is local admin - it works If signing in with username/password on Receiver or Receiver for web - it works. Event generated on vda host: "non-brokered ica connection request denied because th...

Complain Management System - SQL injection Vulnerability

Exploit for php platform in category web applications Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi email protected Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download...

Complain Management System - SQL injection

Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802)

It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802)

It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

DEBIAN-CVE-2016-9844

Buffer overflow in the zishort function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service crash via a large compression method value in the central directory file header...

AZL-6940 CVE-2016-9844 affecting package unzip for versions less than 6.0-19

Buffer overflow in the zishort function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service crash via a large compression method value in the central directory file header...