Unikrn: Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]

Description: ----------- Attacker can update the user's Ad Frequency % using flash + 307 redirect trick by making post request to particular endpoint. Step To Reproduce: ----------- + Get logged at: https://cp-ng.pinion.gg + Visit: http://geekboy.ninja/poc/freq.swf + Ad Frequency should be update...

Fedora 24 : php (2017-5ade380ab2)

PHP version 5.6.31 06 Jul 2017 Core: - Fixed bug php73807 Performance problem with processing post request over 2000000 chars. Nikita - Fixed bug php74111 Heap buffer overread READ: 1 finishnesteddata from unserialize. Nikita - Fixed bug php74603 PHP INI Parsing Stack Buffer Overflow Vulnerabilit...

Citrix CloudBridge CAKEPHP Cookie Command Injection

POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer: https://10.242.129.149/cgi-bin/login.cgi?redirect=/ Cookie: CAKEPHP=sleep 10 Content-Type...

Remote File Upload

kindeditor is vulnerable to remote file upload. The library does not check whether a user has the permission to upload files to the system, allowing a malicious user to upload an arbitrary file to the system through a POST request to the php/uploadjson.php file...

Remote Code Execution (RCE)

phpunit is vulnerable to remote code execution RCE attacks. A malicious user can inject and execute arbitrary PHP script by using the ?php tag and sending a POST request to the eval-stdin.php file on the system...

Stellar.org: Bypassing Verify Humans Page

Hi Team, I was able to bypass verify Human dialog Box , while subscribing . Vulnerable request: ==================== POST /subscribe/post HTTP/1.1 Host: stellar.us9.list-manage.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:54.0 Gecko/20100101 Firefox/54.0 Accept:...

CVE-2017-1326

IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060...

CVE-2017-3216

WiMAX routers based on the MediaTek SDK libmtk that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request...

Gratipay: CSP Policy Bypass and javascript execution

Content Security Policy CSP is a computer security standard introduced to prevent cross-site scripting XSS, clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. CSP provides a standard method for website owners to declare...

Easy File Sharing HTTP Server 7.2 - POST Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Easy File Sharing HTTP Server 7.2 POST Buffer Overflow', 'Description' = %q This module exploits a POST buffer overflow in the Easy File Sharing F...

EFS Software Easy Chat Server Password Reset Vulnerability

EFS Software Easy Chat Server is a simple Web-based chat program from EFS Software. A security vulnerability exists in the register.ghp file in EFS Software Easy Chat Server versions 2.0 through 3.1. A remote attacker can exploit this vulnerability by sending a specially crafted POST request to t...

Design/Logic Flaw

register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm...

CVE-2017-9543

The CVE-2017-9543 entry concerns EFS Software Easy Chat Server (versions 2.0–3.1). The underlying issue is in the register.ghp handling, which allows a remote attacker to reset arbitrary user passwords by sending a crafted POST to registresult.htm. Reported impact includes the ability to change p...

SQL Injection

georgringer/news is vulnerable to SQL Injection. A malicious user can send a POST request with the OrderByAllowed parameter or the DateField parameter and an orderBy parameter to inject and execute arbitrary SQL commands. This can only be done if the overrideDemand is set to one which is the...

CVE-2017-9135

An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program...

Weblate: Csrf in watch-unwatch projects

Hello, When you visit any projects from https://hosted.weblate.org/ , there is a button provided on top-right called Watch / Unwatch for each projects. when you click on that button, a POST request is sent which contains csrf token. But this request also works without that token. Just hit the url...

Gratipay: Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat

Summary It is possible to force send invites for gratipay slack channel to arbitary email ids with no bruteforce limit. This is done by modifying the coc parameter to 1 in the POST data sent from https://inside.gratipay.com/appendices/chat Description Sending a post request with coc parameter set...

Sitecore CMS 8.2 - Cross-Site Scripting / Arbitrary File Disclosure

Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: [email protected] Vendor Homepage: http://www.sitecore.net/ Disclaimer: Everything mentioned below is for educational puposes...

Unauthorised Release Deletion

github.com/gogits/gogs is vulnerable to unauthorised release deletions. A malicious user can delete another user's repository releases by modifying a post request...

Uber: phone number exposure for riders/drivers given email/uuid

Hi , Summary I have found one more vulnerable endpoint that is leaking user's phone number when i submit UUID in the request. This attack works for both Driver and Rider. Security Impact We can get any Rider or Driver private phone number by knowing his UUID. Reproduction Steps 1 . Enter victim's...