NUUO NVRMini2 3.8 - cgi_system Buffer Overflow (Enable Telnet)

NUUO NVRMini2 3.8 - cgisystem Buffer Overflow Enable Telnet Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Date: 2018-09-17 Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2...

NUUO NVRMini2 3.8 - 'cgi_system' Buffer Overflow (Enable Telnet)

Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Date: 2018-09-17 Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2 Versions: 3.8.0 and below Tested Against: 03.07.0000.0011 a...

sebdemilly.com XSS vulnerability

Open Bug Bounty ID: OBB-637073 Description| Value ---|--- Affected Website:| sebdemilly.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Session Fixation

symfony is vulnerable to session fixation. A malicious user that has access to a PHPSESSID can use it through the Guard Authentication feature in a Symfony application to impersonate another user...

WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

CVE-2018-6362

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

Design/Logic Flaw

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

CVE-2018-6362

EHCP (Easy Hosting Control Panel) version 0.37.12.b is affected by a Cross-Site Scripting vulnerability in the domainop action parameter. The vulnerability allows a crafted request to execute script in a user’s browser and, as demonstrated in public advisories, can lead to reading the PHPSESSID c...

CVE-2018-6362

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

mediclickstudio.fr XSS vulnerability

Open Bug Bounty ID: OBB-599161 Description| Value ---|--- Affected Website:| mediclickstudio.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

mediklik.fr XSS vulnerability

Open Bug Bounty ID: OBB-599160 Description| Value ---|--- Affected Website:| mediklik.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

marillion.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-595044 Description| Value ---|--- Affected Website:| marillion.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Authentication flaw

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

CVE-2018-9148

Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...

CVE-2018-9148

CVE-2018-9148 details (WD My Cloud) : WD My Cloud devices with version v04.05.00-320 embed the session token (PHPSESSID) in filenames, enabling directory listing and authentication bypass when combined with CVE-2018-7171. This creates a risk of bypassing access controls via exposed session identi...

Crlf injection

Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie...

CVE-2018-6603

Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie...

CVE-2018-6603

Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie...

rousseau-deschamps.fr XSS vulnerability

Open Bug Bounty ID: OBB-537445 Description| Value ---|--- Affected Website:| rousseau-deschamps.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

stamboom.paulrill.nl XSS vulnerability

Open Bug Bounty ID: OBB-537440 Description| Value ---|--- Affected Website:| stamboom.paulrill.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...