Design/Logic Flaw

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...

CVE-2017-11361

Inteno routers are affected by CVE-2017-11361 due to a JUCI ACL misconfiguration. The issue allows the low-privilege "user" account to read and write files and to add a root SSH key by sending JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be the default "...

CVE-2017-11361

Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus. Exploitation is sometimes easy because the "user" password might be "user" or might match the Wi-Fi key...

The vulnerability of the lockscreen component of the Android operating system allows a hacker to bypass the PIN code lock.

The vulnerability of the Android operating system’s lock screen is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the PIN code lock by pressing the backspace key after each entry when entering the PIN...

Microsoft Azure AD Connect Privilege Elevation Vulnerability (4033453)

This host is missing an important security update according to Microsoft Security Advisory 4033453 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Elastic Kibana 'SSL Client Access' DoS Vulnerability

Elastic Kibana is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:kibana"...

WakaTime: Mailgun misconfiguration

During subdomain enumeration i found the following subdomain: email.mailgun.wakatime.com Looking at the cname records, it is pointing to mailgun. host email.mailgun.wakatime.com email.mailgun.wakatime.com is an alias for mailgun.org. mailgun.org has address 34.225.110.231 mailgun.org has address...

Privilege escalation

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

CVE-2017-8613

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."...

CVE-2017-4970

CVE-2017-4970 describes a regression in the Cloud Foundry cf-release v255 and Staticfile buildpack v1.4.0–v1.4.3. The Staticfile buildpack regression causes the Staticfile.auth configuration to be ignored when the Staticfile is not present in the application root; apps that contain a Staticfile.a...

Foscam camera firewall misconfiguration vulnerability

Foscam camera is a webcam that pushes messages to your phone and also enables video Baidu cloud storage directly through WIFI. There is a misconfiguration vulnerability in the Foscam camera firewall that allows an attacker to perform a brute force attack on credentials despite the presence of a...

The vulnerability of the client in the OpenSSH cryptographic protection mechanism allows a hacker to gain privileged access when interacting with an X11 server.

The vulnerability of the OpenSSH cryptographic protection tool relates to security configuration errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain privileged access when interacting with an X11 server due to incorrect cookies generated for the unencrypted...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application and system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain

Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...

Zomato: Amazon S3 bucket misconfiguration (share)

Hi, Description I have discovered one of your Amazon S3 bucket and tested it via the AWS command line tool on Linux. It looks like permissions are not well configured and allow dangerous actions to everyone. The vulnerable bucket is: zomato-share PoC: aws s3 ls s3://zomato-share aws s3 cp test...

PortSwigger Web Security: Misconfiguration: Missing Custom Error Page (CWE-12 & CWE-756)

Hi I found that custom errors for http://portswigger.net application framework are not configured., so application vulnerable to CWE-756 & CWE-12 https://cwe.mitre.org/data/definitions/12.html https://cwe.mitre.org/data/definitions/756.html - Impact: Default error pages gives detailed information...

Access Restriction Bypass

github.com/opencontainers/runc is vulnerable to attackers bypassing access restrictions. This is possible when ambient capabilities are enabled but misconfigured. It would allow malicious images to bypass user permissions and access other files within the file system and other mounted volumes. Th...

SNMP Incorrect Access Control Vulnerability (CVE 2017-5135) (StringBleed)

In DEFCON 24 IoT Village i gave a talk about the danger of SNMP write properties enabled devices in the IoT, police patrols, ambulances and other in the “critical mission vehicles” were affected in that research. In December 2016 with a colleague from Argentina Ezequiel Fernandez we decided to...

WordPress Plugin Wow Forms 2.1 - SQL Injection

WordPress Plugin Wow Forms 2.1 - SQL Injection Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-forms/ Version: 2.1 Contact: infoattad.group Website:...