Intelligence component Access Modification

The vulnerability of the Intelligence component of the Oracle Sourcing supply management platform’s RFx Creation platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data using the HTTP...

A Bridge Over the Chasm: A Primer on the Release of PCI 4.0

The Payment Card Industry PCI Security Standards Council SSC has just released version 4.0 of the Data Security Standard DSS. Developing DSS 4.0 took almost four years and included several rounds of Request for Comments RFC from Participating Organizations and other interested parties. This new...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

PoC exploit for CVE-2021-4034, a vulnerability in the Apache Log...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell A fully automated, accurate, and extensive scanner for...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell POC Demo This repository contains a submodule, clon...

kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header

A flaw was found in the Linux kernel, where the WiFi implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 ex., LLC/SNAP header for EAPOL. The highest threat from this vulnerability is to integrity...

Exploit for Classic Buffer Overflow in Microsoft

CVE-2017-7269 iis6 exploit 2017 !imagehttps:/...

WPHEKA Request For Quote < 1.3 - CSRF Bypass

The plugin does not properly check for CSRF in its actionwphekaaddtoquote and actionremoveitemfromrfqlist AJAX actions, allowing attacker to make users call them and perform unwanted actions...

Exploit for Server-Side Request Forgery in Microsoft

Exch-CVE-2021-26855 ProxyLogon is the formally generic name fo...

PCI DSS version 4.0 – what we know so far

From September 23 - November 13, 2020, stakeholders can participate in the Request for Comments RFC on the draft of PCI Data Security Standard DSS version 4.0. This is the second RFC for the PCI DSS v4.0 draft--the first RFC was in late 2019 and that feedback was incorporated into the draft...

EAP: field-name is not parsed in accordance to RFC7230

A flaw was discovered in JBoss EAP, where it does not process the header field-name in accordance with RFC7230. Whitespace between the header field-name and colon is processed, resulting in an HTTP response code of 200 instead of a bad request of 400...

Libidn2 RFC3490 Domain Creation

The vulnerability of component RFC3490 of the Libidn2 library exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to create a malicious domain that corresponds to the target domain...

my.bigstep.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1036953 Security Researcher jannmoon Helped patch 5 vulnerabilities Received 0 Coordinated Disclosure badges Received 1 recommendations , found a security vulnerability affecting my.bigstep.com website and its users. Following coordinated and responsible vulnerability...

Cross site request forgery (csrf)

The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation with the none role via a request for variants...

Preparing for PCI DSS 4.0

PCI DSS 4.0 is currently in its request for comments RFC process, where the industry can provide comments and feedback to help shape the next iteration. This process is initially open to the participating organizations - members that help steer and inform the PCI SSC based on their experiences. T...

Exploit for Out-of-bounds Write in Libgd

exploits Some exploits I have written to showcase and to share...

SAP Internet Graphics Server HTTP and RFC listener denial of service vulnerability

SAP Internet Graphics Server IGS is a graphics server from SAP, Germany. The product is able to generate graphs or charts in different areas.HTTP is one of the hypertext transfer protocols; RFC listener is one of the RFC listener. A security vulnerability exists in HTTP and RFC listener in SAP IG...

PT-2018-2891

Name of the Vulnerable Software and Affected Versions HAProxy versions 1.8.0 through 1.8.9 Description The issue is related to incorrect caching of responses to requests including an Authorization header, which allows attackers to achieve information disclosure via an unauthenticated remote...

Threat Outbreak Alert RuleID30637: Email Messages Distributing Malicious Software on September 18, 2017

Medium Alert ID: 55318 First Published: 2017 September 18 14:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30637 may contain the following files: Name ...

Threat Outbreak Alert RuleID29243: Email Messages Distributing Malicious Software on May 23, 2017

Medium Alert ID: 53929 First Published: 2017 May 23 15:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29243 may contain the following files: Name | Size...