Open-Xchange: IDOR - setAttribute action of user object in API

Note. I selected sandbox.open-xchange.com as the asset in Hackerone but this was tested on a local installation . Hello, There appears to be a possible IDOR vulnerability in the following API endpoint for setting custom attributes:...

Cisco UCS Platform Emulator 3.1(2ePE1) - Remote Code Execution

Cisco UCS Platform Emulator 3.12ePE1 - Remote Code Execution Vulnerabilities Summary The following advisory describes two remote code execution vulnerabilities found in Cisco UCS Platform Emulator version 3.12ePE1. Cisco UCS Platform Emulator is the Cisco UCS Manager application bundled into a...

International Islamic University Chittagong: XSS Via error message

Hi Team, found xss via error message. PoC: Navigate to http://119.18.148.140/hrd/login.php?error=%3Cscript%3Econfirm1%3C/script%3E%20ID%20or%20Password%20does%20not%20find. Regards, Mr.R3boot...

Uniview - Remote Command Execution Export Config (PoC)

Uniview - Remote Command Execution Export Config PoC STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config...

Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

Oracle FCDB <= 10.5 Cross Site Scripting Vulnerability

Exploit for multiple platform in category remote exploits Title: Cross Site Scripting - Oracle Flex cube Direct Banking Application 10.5 Application: Oracle FCDB Versions Affected: Oracle Flex cube Direct Banking Software 10.5 Note: The payload will bypass the most of the WAFs running behind the...

X (Formerly Twitter): Open Redirect Protection Bypass

Hi Report 281538 is fixed but Attacker can Bypass this Open Redirect Protection. Give this link https://twitter.com/teams/authorize?targetscreenname=&authorizecallback=//www.facebook.com to authorized victim.Twitter will say him to authorize a different account for create team.After authorization...

Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow (PoC)

Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow PoC / Sync Breeze Enterprise BOF - Ivan Ivanovic Ivanov Иван-дурак недействительный 31337 Team / define WINSOCKDEPRECATEDNOWARNINGS define DEFAULTBUFLEN 512 include include include include DWORD SendRequestchar request, int requestsize WSADA...

Tizen Studio 1.3 Smart Development Bridge < 2.3.2 - Buffer Overflow (PoC)

Exploit Title: Smart Development Bridge =2.3.2 part of Tizen Studio 1.3 Windows x86/x64 - Buffer Overflow PoC Date: 22.10.17 Exploit Author: Marcin Kopec Vendor Homepage: https://developer.tizen.org/ Software Link: https://developer.tizen.org/development/tizen-studio/download Version: 2.3.0, 2.3....

Tizen Studio 1.3 Smart Development Bridge Buffer Overflow

Exploit Title: Smart Development Bridge =2.3.2 part of Tizen Studio 1.3 Windows x86/x64 - Buffer Overflow PoC Date: 22.10.17 Exploit Author: Marcin Kopec Vendor Homepage: https://developer.tizen.org/ Software Link: https://developer.tizen.org/development/tizen-studio/download Version: 2.3.0, 2.3....

PHPMailer 5.2.21 Local File Disclosure

Exploit Title: PHPMailer SetFrom$POST"your-email", $POST"your-name"; $address = "admin@localhost"; $mail-AddAddress$address, "root"; if isset$POST'cc' $mail-AddCC$POST"your-email", $POST"your-name"; $mail-Subject = "PHPMailer MsgHTML$POST"your-message"; if!$mail-Send echo "Error: ".$mail-ErrorInf...

FS Crowdfunding Script SQL Injection

Exploit Title: FS Crowdfunding Script - 'id' SQL Injection Date: 2017-10-24 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/crowdfunding-script/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email:...

FS Indiamart Clone - keywords SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Indiamart Clone - SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS...

Ayukov NFTP FTP Client Stack Buffer Overflow Analysis

Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code. Recent assessments: wchen-r7 at September 12, 2019 6:08pm UTC reported: Details Ayukov is an FTP client that was written by Sergey Ayukov back in 1994. Development stopped in 2011, and...

FS Expedia Clone SQL Injection

Exploit Title: FS Expedia Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/expedia-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected] Contac...

FS Monster Clone - 'id' SQL Injection

Exploit Title: FS Monster Clone - 'id' SQL Injection Date: 2017-10-24 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/monster-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

FS Book Store Script - category SQL Injection

FS Book Store Script - category SQL Injection Exploit Title: FS Book Store Script - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/book-store-script/ Version: 23 October 17 Tested on: Kali Linux...

FS Indiamart Clone - keywords SQL Injection

FS Indiamart Clone - keywords SQL Injection Exploit Title: FS Indiamart Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 |...

FS Expedia Clone - hid SQL Injection

FS Expedia Clone - hid SQL Injection Exploit Title: FS Expedia Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/expedia-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS...

FS Indiamart Clone - 'keywords' SQL Injection

Exploit Title: FS Indiamart Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/indiamart-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...