GitLab 12.9.0 - Arbitrary File Read Exploit

Exploit for ruby platform in category web applications Exploit Title: GitLab 12.9.0 - Arbitrary File Read Exploit Author: KouroshRZ Vendor Homepage: https://about.gitlab.com Software Link: https://about.gitlab.com/install Version: tested on gitlab version 12.9.0 Tested on: Ubuntu 18.04 but it's O...

Convincing Google Impersonation Opens Door to MiTM, Phishing

An attack that uses homographic characters to impersonate domain names and launch convincing but malicious websites takes minutes and a bare modicum of skill — while reaping high rates of success in luring victims, according to an independent researcher. Researcher Avi Lumelsky set out to see how...

GLSA-202003-09 : OpenID library for Ruby: Server-Side Request Forgery

The remote host is affected by the vulnerability described in GLSA-202003-09 OpenID library for Ruby: Server-Side Request Forgery It was discovered that OpenID library for Ruby performed discovery first, and then verification. Impact : A remote attacker could possibly change the URL used for...

OpenID library for Ruby: Server-Side Request Forgery

Background A Ruby library for verifying and serving OpenID identities. Description It was discovered that OpenID library for Ruby performed discovery first, and then verification. Impact A remote attacker could possibly change the URL used for discovery and trick the server into connecting to the...

[SECURITY] [DLA 1956-1] ruby-openid security update

Package : ruby-openid Version : 2.5.0debian-1+deb8u1 CVE ID : CVE-2019-11027 ruby-openid performed discovery first, and then verification. This allowed an attacker to change the URL used for discovery and trick the server into connecting to the URL. This server in turn could be a private server n...

ALPINE-CVE-2019-12795

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. Note that the server socket...

Helm Wants You to Control Your Own Data Again

Helm hopes to make running your own private, encrypted server easy for everyone...

Lucy Gang Debuts with Unusual Android MaaS Package

There’s a fresh bloom in the malware-as-a-service garden: Researchers have uncovered a new Russian-speaking threat actor hawking a proprietary cyber-weapon dubbed “Black Rose Lucy.” The offering is a malware-as-a-service MaaS bundle with two parts, consisting of a controlling web interface which...

Automattic: Internal GET SSRF via CSRF with Press This scan feature

Description ----------------------------------- The url http://xxx.xxx.xxx.xxx/wp-admin/press-this.php?u=URLTOSCRAPE&url-scan-submit=Scan does not validate that user intends to send a scrape request. The filter does not validate for 0.0.0.0:PORT and allows the attacker to make the victim send GET...

XSS vulnerability in 4shared and NATO Multimedia Library Exposed

Inj3ct0r Team found cross site scripting vulnerability in 4shared , a file sharing site. Vulnerability link is exposed in a note available at their website. In general, cross-site scripting refers to that hacking technique that leverages vulnerabilities in the code of a web application to allow a...

Wordpress (install.php) Any Version

Exploit for php platform in category web applications =================================== Wordpress install.php Any Version =================================== + : Author : ThE DarK + : e-Mail : email protected + : Sites : Arab-Hack.net , Sa-Hacker.Com , Gaza-Hack.net , error-y.com + : Software...

CVE-2006-2472

Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys...

CVE-2006-2472

BEA WebLogic Server versions affected: 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7. The CVE-2006-2472 entry describes an unspecified vulnerability that allows untrusted applications to obtain private server keys. The connected documents corroborate the affected product and ...

Design/Logic Flaw

Virtual Private Server Vserver 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities ccaps that allow local guest users to perform operations that were only intended to be allowed by the guest-root...

CVE-2006-2110

Virtual Private Server Vserver 2.0.x before 2.0.2-rc18 and 2.1.x before 2.1.1-rc18 provides certain context capabilities ccaps that allow local guest users to perform operations that were only intended to be allowed by the guest-root...

Minutes down the law, quickly click a entertainment Station-vulnerability warning-the black bar safety net

“In order to She is again reluctant to talk about the theory of love,and then cheer to comfort the understanding of others”, and I do,“I in order to it again efforts to combat, again fen for themselvesservice......” Unfortunately this entertainment station in Saga private server in the equipment...