12946 matches found
WordPress CMS Tree Page View 1.4 CSRF / Privilege Escalation
Exploit Title: CMS Tree Page View CSRF, Privilege Escalation Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link: https://wordpress.org/plugins/cms-tree-page-view Version: 1.4 Tested on:...
Joomla Ad Agency 6.0.9 SQL Injection Vulnerability
Exploit for php platform in category web applications Document Title: =============== iJoomla comadagency 6.0.9 - SQL Injection Vulnerabilities Product & Service Introduction: =============================== Ad Agency is the 1 advertising extension for Joomla! Start generating income from your...
Icyphoenix 2.2.0.105 SQL Injection Vulnerability
Exploit for php platform in category web applications Document Title: =============== Icyphoenix 2.2.0.105 - Multiple SQL Injection Vulnerabilities Product & Service Introduction: =============================== Icy Phoenix is a CMS based on phpBB engine a fully scalable and highly customisable...
Kindred Group: Full Account Takeover on *.unibet.com due to crossdomain.xml and AkamaiPlayer loaderContext
==Below is the original, partially-redacted report== --------- Hi, The core issue here are two things: 1. The too wide crossdomain.xml located at: https://payment.unibet.com/crossdomain.xml https://se.unibet.com/crossdomain.xml https://www.unibet.com/crossdomain.xml 2. Issues with not-in-scope...
Reading privileged memory with a side-channel (Meltdown & Spectre)
We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to at worst arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. Variants of this issue are known to affect many mode...
Joomla RealEstateManager 4.2.0 SQL Injection
Title: Joomla RealEstateManager 4.2.0 - SQL injection Credit: Bilal KARDADOU Vendor: http://ordasoft.com/ URL: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/realestatemanager/ Product: 'Joomla RealEstateManager 4.2.0' Developer: OrdaSoft Extension type: Plugin La...
15-Year-Old Apple macOS 0-Day Kernel Flaw Disclosed, Allows Root Access
A security researcher on New Year's eve made public the details of an unpatched security vulnerability in Apple's macOS operating system that can be exploited to take complete control of a system. On the first day of 2018, a researcher using the online moniker Siguza released the details of the...
Automattic: Remote Code Execution in Wordpress Desktop
An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...
D3DGear 5.00 Build 2175 - Buffer Overflow (PoC)
D3DGear 5.00 Build 2175 - Buffer Overflow PoC !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: D3DGear 5.00 Build 2175 - Buffer Overflow Date: 07-11-2017 Vulnerable Software: D3DGear 5.00 Build 2175 Vendor Homepage: http://www.d3dgear.com/ Version: 5.00 Build 2175 Software Link...
D3DGear 5.00 Build 2175 - Buffer Overflow (PoC)
!/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: D3DGear 5.00 Build 2175 - Buffer Overflow Date: 07-11-2017 Vulnerable Software: D3DGear 5.00 Build 2175 Vendor Homepage: http://www.d3dgear.com/ Version: 5.00 Build 2175 Software Link: http://www.d3dgear.com/products.htm Tested O...
ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability
Summary ZKAccess Systems are built on flexible, open technology to provide management, real-time monitoring, and control of your access control system-all from a browser, with no additional software to install. Our secure Web-hosted infrastructure and centralized online administration reduce your...
InfraPower PPS-02-S Q213V1 Insecure Direct Object Reference Authorization Bypass
Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...
Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak
Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description Insecure direct object references occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attacke...
Dell SonicWALL Global Management System GMS 8.1 Blind SQL Injection
Summary Provide your organization, distributed enterprise or managed service offering with an intuitive, powerful way to rapidly deploy and centrally manage SonicWall solutions, with SonicWall GMS. Get more value from your firewall, secure remote access, anti-spam, and backup and recovery solutio...
Automattic: Stored XSS in www.learnboost.com via ZIP codes.
Summary --- www.learnboost.com is vulnerable to stored XSS via ZIP codes stored alongside school names in the Network panel. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- Visit https://www.learnboost.com/settings/network/search and search for fro. My entry will trigger the XSS...
Easy!Appointments 1.2.1 - Cross-Site Scripting
Easy!Appointments 1.2.1 - Cross-Site Scripting Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities Vendor: Alex Tselegidis Product web page: http://www.easyappointments.org Affected version: 1.2.1 Summary: Easy!Appointments is a highly customizable web application that allows your...
Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery
Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution Vendor: Telesquare Co., Ltd. Product web page: http://www.telesquare.co.kr Affected version: FwVer: SDT-CS3B1, sw version 1.2.0 LteVer: ML300S5XEA41090 1 0.1.0 Modem model: PM-L300S Summary: We introduce SDT-CS3B1 LTE router which ...
Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery
Telesquare SKT LTE Router SDT-CS3B1 - Cross-Site Request Forgery Telesquare SKT LTE Router SDT-CS3B1 CSRF System Command Execution Vendor: Telesquare Co., Ltd. Product web page: http://www.telesquare.co.kr Affected version: FwVer: SDT-CS3B1, sw version 1.2.0 LteVer: ML300S5XEA41090 1 0.1.0 Modem...
Easy!Appointments 1.2.1 - Cross-Site Scripting
Easy!Appointments v1.2.1 Multiple Stored XSS Vulnerabilities Vendor: Alex Tselegidis Product web page: http://www.easyappointments.org Affected version: 1.2.1 Summary: Easy!Appointments is a highly customizable web application that allows your customers to book appointments with you via the web...
Concrete CMS: Stored XSS on Add Event in Calendar
Greetings In crayons we trust Hello @Concrete5 Team. While checking the Hacktivity in your HackerOne Program I saw many reports regarding to XSS thus I will omit the vulnerability description I'm going to report now. After downloaded Concrete5 8.3.1 released at 12/20/17, while searching for some...