elektrobock.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1121429 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Apache Tomcat from file contains to RCE exploit the principle of in-depth analysis-vulnerability warning-the black bar safety net

The content of the article introduction The present article is directed to the Apache Tomcat Ajp（CVE-2020-1938）the vulnerability file contains and RCE of the use of methods and principles for the in-depth analysis, including vulnerability to reproduce and analyze the environment to build the...

CVE-2020-6582

CVE-2020-6582 affects Nagios NRPE 3.2.1 and is described in connected advisories as a heap-based buffer overflow caused by interpreting a small negative number as a large positive one during a bzero call. Mageia and Fedora/OpenVAS advisories indicate NRPE updates exist (NRPE 4.x, e.g., 4.0.2) as ...

APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT

Since the coronavirus became a worldwide health issue, the desire for more information and guidance from government and health authorities has reached a fever pitch. This is a golden opportunity for threat actors to capitalize on fear, spread misinformation, and generate mass hysteria—all while...

Amazon Linux AMI : php73 (ALAS-2020-1351)

The version of php73 installed on the remote host is prior to 7.3.15-1.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1351 advisory. In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension,...

blaxakis.gr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1117457 Security Researcher geeknik Helped patch 8803 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting blaxakis.gr website and it...

campveersetoren.nl Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1116537 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting campveersetoren.nl website...

farmiq.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1114143 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

WAGO PFC200 Cloud Connectivity TimeoutPrepared Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200. An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command. Tested Versions WAGO PFC200 Firmware version...

Let's Encrypt Vulnerability

The BBC is reporting a vulnerability in the Let's Encrypt certificate service: In a notification email to its clients, the organisation said: "We recently discovered a bug in the Let's Encrypt certificate authority code. "Unfortunately, this means we need to revoke the certificates that were...

medanta.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109584 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

DoppelPaymer Ransomware Used to Steal Data from Supplier to SpaceX, Tesla

A company that provides custom parts to aerospace giants Lockheed Martin, SpaceX and Boeing, has been the target of an attack by an emerging type of ransomware that can both encrypt files and exfiltrate data. Colorado-based Visser Precision said it was targeted by a “cyber incident” that involved...

human-capital.com.ua Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109034 Security Researcher geeknik Helped patch 8949 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting human-capital.com.ua websi...

netkit-telnet-0.17 telnetd (Fedora 31) - BraveStarr Remote Code Execution

netkit-telnet-0.17 telnetd Fedora 31 - BraveStarr Remote Code Execution !/usr/bin/env python3 BraveStarr ========== Proof of Concept remote exploit against Fedora 31 netkit-telnet-0.17 telnetd. This is for demonstration purposes only. It has by no means been engineered to be reliable: 0xff bytes ...

Wing FTP Server 6.2.3 Privilege Escalation

Exploit Title: Wing FTP Server 6.2.3 - Privilege Escalation Google Dork: intitle:"Wing FTP Server - Web" Date: 2020-03-02 Exploit Author: Cary Hooper Vendor Homepage: https://www.wftpserver.com Software Link: https://www.wftpserver.com/download/wftpserver-linux-64bit.tar.gz Version: v6.2.3 Tested...

news.red-rock-group.com Cross Site Scripting vulnerability

Security Researcher 4NCURZE Helped patch 1397 vulnerabilities Received 7 Coordinated Disclosure badges Received 12 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting news.red-rock-group.com website and its users. Following...

CVE-2019-17030

...

Apache Tomcat AJP Ghostcat File Read / Inclusion

!/usr/bin/env python CNVD-2020-10487 Tomcat-Ajp lfi by ydhcui import struct Some references: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html def packstrings: if s is None: return struct.pack"h", -1 l = lens return struct.pack"H%dsb" % l, l, s.encode'utf8', 0 def unpackstream, fmt: size ...

bestgenetics.at Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1102817 Security Researcher Broly157 Helped patch 1609 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting bestgenetics.at website a...

osquery:osqueryfuzz-sqlquery: Heap-use-after-free in binCollFunc

Project: https://github.com/osquery/osquery.git Detailed Report: https://oss-fuzz.com/testcase?key=5174631483047936 Project: osquery Fuzzing Engine: libFuzzer Fuzz Target: osqueryfuzz-sqlquery Job Type: libfuzzerasanosquery Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address:...