CVE-2016-1698

The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition...

Design/Logic Flaw

The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition...

New Relic: Blind SSRF on synthetics.newrelic.com

Introduction It was possible to retrieve some data from the http://169.254.169.254/latest/ URL corresponding to the amazon instance metadatas. With more time, we can dump the whole content. PoC When creating a Ping Monitor on the https://synthetics.newrelic.com/accounts/XXXXXXX/synthetics URL, it...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

FreeBSD : ImageMagick -- multiple vulnerabilities (0d724b05-687f-4527-9c03-af34d3b094ec) (ImageTragick)

Openwall reports : Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats. Any service which uses ImageMagick to process user-supplied images and uses default delegates.xml / policy.xml, may be vulnerable to this...

Mapbox: Denial of service in account statistics endpoint

Hi Mapbox, I know that your guidelines explicitly say that Denial of Service coinditions are not in scope and should not be attempted, but I maintained the testing between adequate parameters so as to not to create excessive load on your backend. I also sent an email to [email protected] prior ...

Response Operation Collection Kit: ROCK NSM

MOCYBER’s open source Network Security Monitoring platform ROCK is a collections platform, in the spirit of Network Security Monitoring, designed by members of the Missouri National Guard’s Cyber Team. It’s primary focus is to provide a robust, scalable sensor platform for both enduring security...

Moxa Won't Patch Publicly Disclosed Flaws Until August

Update A number of publicly disclosed vulnerabilities in Moxa networking gear won’t be patched until August, if at all, according to an alert published on Friday by the Industrial Control System Cyber Emergency Response Team ICS-CERT. Researcher Joakim Kennedy of Rapid7 disclosed in March some...

Apple, Google Faced All Writs Act Orders

The American Civil Liberties Union has dug up more proof that from the get-go the FBI’s attempt to crack open an iPhone used by the San Bernardino shooter Syed Rizwan Farook was not just about the one phone. The ACLU found court documents and on Wednesday published an interactive map visualizing...

LynxFramework - Extension Exploitation Framework

LynxFramework is an operating tool for web browser offering a specialized service in the effect browser extension development , namely Google Chrome and Firefox soon. The operation is based on the script for the injection in the order to retrieve data targeted. LynxFramework est un outil...

Microsoft Edge browser vulnerability, which allows a hacker to access the browser’s history or retrieve other information

The vulnerability of Microsoft Edge is related to errors in the Referer policy processing. Exploiting this vulnerability can allow a malicious actor to gain access to the browser history or request other information through a specially crafted HTTPS website...

Sysax Multi Server 6.50 - HTTP File Share SEH Overflow Remote Code Execution

Exploit for windows platform in category remote exploits Exploit Title: Sysax Multi Server 6.50 HTTP File Share SEH Overflow RCE Exploit Date: 03/21/2016 Exploit Author: Paul Purcell Contact: ptpxploit at gmail Vendor Homepage: http://www.sysax.com/ Vulnerable Version Download:...

Cisco Universal Small Cell Devices Unauthorized Firmware Retrieval Vulnerability

A vulnerability in Cisco Universal Small Cell devices could allow an unauthenticated, remote attacker to retrieve firmware from a Cisco-hosted binary server. The vulnerability is due to insufficient enforcement of the two-way certificate validation process by the Cisco-hosted binary server to...

D-Link DSL-2750B Remote Command Execution

After some playing around I've noticed something interesting during login phase: by sending wrong credentials, user is redirected on an error page with url http://192.168.1.1:666/login.cgi?cli=access%20login%20encrypted%2041544A25DC00170BA90659AD4CBDD9D9$ http://imgur.com/ZG1vU2t In order to see...

WordPress WP Invoice Plugin <= 4.1.0 - Multiple Vulnerabilities

This plugin is prone to unauthorized setting changes, retrieving invoices of arbitrary users, updating previously invoiced users meta data and privilege escalation of logged in users. Solution Update the plugin...

CVE-2016-1493

Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file...

CVE-2016-1493

Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file...

Tor: [tor] control connection pre-auth DoS (infinite loop) with --enable-bufferevents

In control.c, this is the loop that retrieves data from the input buffer of the connection, or returns if no complete linefreed-terminated line is available connectionfetchfrombufline returns 0. c 4225 while 1 4226 sizet lastidx; 4227 int r; 4228 / First, fetch a line. / 4229 do 4230 datalen =...

XXEinjector - Tool For Automatic Exploitation Of XXE Vulnerability

XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file Mandatory - fil...

AdMentor 1.00 Database Disclosure

| Title : AdMentor 1.00 Database Disclosure Exploit | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Vendor : http://adyou.me/4TVD ========================================================= !/usr/bin/perl -w AdMentor 1.00 Database Disclosure Exploit...