143 matches found
CVE-2023-29199
creationtimestamp| type| source ---|---|--- 2023-04-12 20:42:44+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-xj72-wvfv-8985 2023-04-14 22:26:07+00:00| seen| https://t.me/cibsecurity/62178 2023-04-18 18:14:21+00:00| published-proof-of-concept| https://t.me/truesecator/4299...
SUSE CVE-2007-1358
Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...
cve-reported
CVE reported...
Exploit for OS Command Injection in Cacti
CVE-2020-8813 - RCE through grap...
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...
The vulnerability of the Intelligence component of the Oracle Sourcing supply management platform’s RFx Creation platform allows a hacker to gain read, modify, add, or delete access to data.
The vulnerability of the Intelligence component of the Oracle Sourcing supply management platform’s RFx Creation platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data using the HTTP...
A Bridge Over the Chasm: A Primer on the Release of PCI 4.0
The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...
Exploit for Out-of-bounds Write in Polkit_Project Polkit
PoC exploit for CVE-2021-4034, a vulnerability in the Apache Log...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4shell A fully automated, accurate, and extensive scanner for...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4Shell POC Demo This repository contains a submodule, clon...
kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header
A flaw was found in the Linux kernel, where the WiFi implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 ex., LLC/SNAP header for EAPOL. The highest threat from this vulnerability is to integrity...
DNSTake - A Fast Tool To Check Missing Hosted DNS Zones That Can Lead To Subdomain Takeover
A fast tool to check missing hosted DNS zones that can lead to subdomain takeover. What is a DNS takeover? DNS takeover vulnerabilities occur when a subdomain subdomain.example.com or domain has its authoritative nameserver set to a provider e.g. AWS Route 53, Akamai, Microsoft Azure, etc. but th...
Exploit for Classic Buffer Overflow in Microsoft
CVE-2017-7269 iis6 exploit 2017 !imagehttps:/...
WPHEKA Request For Quote < 1.3 - CSRF Bypass
The plugin does not properly check for CSRF in its actionwphekaaddtoquote and actionremoveitemfromrfqlist AJAX actions, allowing attacker to make users call them and perform unwanted actions...
Exploit for Server-Side Request Forgery in Microsoft
Exch-CVE-2021-26855 ProxyLogon is the formally generic name fo...
PCI DSS version 4.0 – what we know so far
From September 23 - November 13, 2020, stakeholders can participate in the Request for Comments RFC on the draft of PCI Data Security Standard DSS version 4.0. This is the second RFC for the PCI DSS v4.0 draft--the first RFC was in late 2019 and that feedback was incorporated into the draft...
EAP: field-name is not parsed in accordance to RFC7230
A flaw was discovered in JBoss EAP, where it does not process the header field-name in accordance with RFC7230. Whitespace between the header field-name and colon is processed, resulting in an HTTP response code of 200 instead of a bad request of 400...
The vulnerability of component RFC3490 of the Libidn2 library allows a attacker to create a malicious domain that corresponds to the target domain.
The vulnerability of component RFC3490 of the Libidn2 library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to create a malicious domain that corresponds to the target domain...
my.bigstep.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1036953 Security Researcher jannmoon Helped patch 5 vulnerabilities Received 0 Coordinated Disclosure badges Received 1 recommendations , found a security vulnerability affecting my.bigstep.com website and its users. Following coordinated and responsible vulnerability...
