Upgraded Q -> 2 from #625 [1677633526031]

Judge has assessed an item in Issue 625 as 2 risk. The relevant finding follows: 4. lastHarvest variable inside AdapterBase will never be updated after a successful harvest,this will create big problems related to all the harvest function inside AdapterBase by making this function unusable,in fac...

Upgraded Q -> 2 from #206 [1676531414343]

Judge has assessed an item in Issue 206 as 2 risk. The relevant finding follows: Issue 2: receipts are not burned upon claiming reward. In my opinion, current system of just claiming some tokens to be "used" has some downsides: in any claim check, users spend gas to iterate over these tokens too...

JSA10570 - 2013-05 Network Management, Identity and Policy Control Security Advisories Released

Last Modified Date Mar 10, 2023 8:08:38 AM...

JSA10385 - Certain crafted packets can crash Steel-Belted Radius or hijack the server machine.

Last Modified Date Mar 10, 2023 8:08:40 AM...

SAP Web Dispatcher HTTP Request Smuggling

Onapsis Security Advisory 2022-0001: HTTP Request Smuggling in SAP Web Dispatcher Impact on Business By injecting an HTTP request as a prefix into a victim's request, a malicious user is able to cause damage in different ways, such as producing a Denial of Service by setting an invalid request as...

SAP Netweaver JAVA 7.50 Missing Authorization

Onapsis Security Advisory 2021-0013: CVE-2020-26829 - Missing Authentication Check In SAP NetWeaver AS JAVA P2P Cluster communication Impact on Business A malicious unauthenticated user could abuse the lack of authentication check on SAP Java P2P cluster communication, in order to connect to the...

Moriarty-Project - This Tool Gives Information About The Phone Number That You Entered

What IS Moriarty? Advanced Information Gathering And Osint Tool Moriarty is a tool that tries to find good information about the phone number that you provieded; -Tries To Find Owner Of The Number -Tries To Find Risk Level Of The Number -Tries To Find Location,Time Zone Of The Number,Carrier -Tri...

Why SecOps is (Still) the Future

Editor’s Note: Sam Bocetta, a guest author on the VMware Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. SecOps is not a new idea. Unfortunately, however, it is...

Logitech R700 Laser Presentation Remote Keystroke Injection Vulnerability

Product: R700 Laser Presentation Remote Manufacturer: Logitech Affected Versions: Model R-R0010 PID WD904XM and PID WD802XM Tested Versions: Model R-R0010 PID WD904XM and PID WD802XM Vulnerability Type: Insufficient Verification of Data Authenticity CWE-345 Keystroke Injection Vulnerability Risk...

Sitadel - Web Application Security Scanner

Sitadel is basically an update for WAScan making it compatible for python = 3.4 It allows more flexibility for you to write new modules and implement new features : Frontend framework detection Content Delivery Network detection Define Risk Level to allow for scans Plugin system Docker image...

PORTIER 4.4.4.2 / 4.4.4.6 SQL Injection Vulnerability

Exploit for php platform in category web applications PORTIER 4.4.4.2 / 4.4.4.6 SQL Injection Product: PORTIER Affected Versions: 4.4.4.2, 4.4.4.6 Tested Versions: 4.4.4.2, 4.4.4.6 Vulnerability Type: SQL Injection CWE-89 Risk Level: HIGH Solution Status: Open Manufacturer Notification: 2018-06-1...

WordPress: [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II

Subject: FG-VD-18-165 Wordpress Cross-Site Scripting Vulnerability Notification II Dear Wordpress, Fortinet's FortiGuard Labs have discovered a security issue in your product Wordpress on 12/11/2018. We estimate its risk level is 3, on a scale of 1 lowest to 5 highest, in terms of its impact...

Outpost24 OUTSCAN for detecting vulnerabilities on your network perimeter

Today I would like to write a post about Outpost24. This company was founded in 2001. For comparison, Tenable was founded in 2002 and Qualys in 1999. So, it's a company with a pretty long history. Outpost24 make Vulnerability Management & Web Application Security products and provide various...

Squirrelmail 1.4.22 Remote Code Execution

Advisory ID: SGMA17-001 Title: Squirrelmail Remote Code Execution Product: Squirrelmail Version: 1.4.22 and probably prior Vendor: squirrelmail.org Type: Command Injection Risk level: 4 / 5 Credit: [email protected] CVE: CVE-2017-7692 Vendor notification: 2017-04-04 Vendor fix:...

Simplessus Files 3.7.7 Path Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2017-004 Product: Simplessus Files Manufacturer: Simplessus Affected Versions: 3.7.7 Tested Versions: 3.7.7 Vulnerability Type: Path Traversal CWE-22 Risk Level: High Solution Status: Fixed Manufacturer Notification: January 25, 20...

Radisys MRF - Command Injection

Radisys MRF - Command Injection Title: MRF Web Panel OS Command Injection Vendor: Radisys Vendor Homepage: http://www.radisys.com Product: MRF Web Panel SWMS Version: 9.0.1 CVE: CVE-2016-10043 CWE: CWE-78 Risk Level: High Discovery: Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos COSMOT...

Davolink DV-2051 - Multiple Vulnerabilities

=================================================================== Title: Unauthenticated admin password change Product: Davolink modem Tested model: DV-2051 Vulnerability Type: Missing Function Level Access Control CWE-306 Risk Level: High Solution Status: No fix available Discovered and...

iTop 2.2.1 - Cross-Site Request Forgery

Exploit for php platform in category web applications Product: iTop Vendor: Combodo Vulnerable Versions: 2.2.1 and probably prior Tested Version: 2.2.1 Advisory Publication: February 10, 2016 without technical details Vendor Notification: February 10, 2016 Vendor Patch: February 11, 2016 Public...

ProjectSend r582 - Multiple Vulnerabilities

ProjectSend r582 - Multiple Vulnerabilities Advisory ID: SGMA-16001 Title: ProjectSend multiple vulnerabilities Product: ProjectSend previously cFTP Version: r582 and probably prior Vendor: www.projectsend.org Vulnerability type: SQL-injection, Auth bypass, Arbitrary File Access, Insecure Object...

HumHub 0.11.2 and 0.20.0-beta.2 - SQL 注入漏洞

寻找SQL注入的一般步骤： 1、寻找数据输入（表单） 2、注入数据 3、检测异常响应，像HTTP的500错误，SQL报错 该过程可以借助多种工具实现自动化。 用AWVS检测出 /index.php 可能存在SQL注入。 以下地址会报SQL错误，from 字段是注入点: http://localhost/index.php?from=1'"&limit=10&mode=activity&r=space/space/stream&sguid=e9659cfc-886f-4524-94ae-1721999ad43b...