subsonicdevice.com XSS vulnerability

Open Bug Bounty ID: OBB-472565 Description| Value ---|--- Affected Website:| subsonicdevice.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

Happy 8th Birthday, KrebsOnSecurity!

Eight years ago today I set aside my Washington Post press badge and became an independent here at KrebsOnSecurity.com. What a wild ride it has been. Thank you all, Dear Readers, for sticking with me and for helping to build a terrific community. This past year KrebsOnSecurity published nearly 16...

Iopsys Router - dhcp Remote Code Execution

Iopsys Router - dhcp Remote Code Execution !/usr/bin/python import json import sys import subprocess import socket import os from time import sleep from websocket import createconnection def ubusAuthhost, username, password: ws = createconnection"ws://" + host, header = "Sec-WebSocket-Protocol:...

tekmarcontrols.com XSS vulnerability

Open Bug Bounty ID: OBB-456401 Description| Value ---|--- Affected Website:| tekmarcontrols.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

Linux/x64 - Custom Encoded XOR + Polymorphic + execve(/bin/sh) Shellcode (Generator)

Linux/x64 - Custom Encoded XOR + Polymorphic + execve/bin/sh Shellcode Generator. Shellcode exploit for Generator platform !/usr/bin/python from random import randint encoded = "" encoded2 = "" badchars = 0x00 shellcode = "\x90" +...

nl.bongacam.ru XSS vulnerability

Open Bug Bounty ID: OBB-452174 Description| Value ---|--- Affected Website:| nl.bongacam.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

LabF nfsAxe FTP Client 3.7 Buffer Overflow

!/usr/bin/env python Exploit Title : LabF nfsAxe 3.7 FTP Client DEP Bypass Date : 12/8/2017 Exploit Author : wetw0rk Vendor Homepage : http://www.labf.com/nfsaxe/nfs-server.html Software link : http://www.labf.com/download/nfsaxe.exe Version : 3.7 Tested on : Windows 7 x86 Description : Upon...

DomainSale PHP Script 1.0 - id SQL Injection

DomainSale PHP Script 1.0 - id SQL Injection Exploit Title: DomainSale PHP Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.codester.com/ChewiScripts Software Link: https://www.codester.com/items/5301/domainsale-php-script Demo:...

Threat Outbreak Alert RuleID31550: Email Messages Distributing Malicious Software on December 6, 2017

Medium Alert ID: 56171 First Published: 2017 December 6 14:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31550 may contain the following files: Name |...

Techno Portfolio Management Panel - 'id' SQL Injection

Exploit Title: Techno - Portfolio Management Panel 1.0 - SQL Injection Dork: N/A Date: 02.12.2017 Vendor Homepage: https://codecanyon.net/user/engtechno Software Link: https://codecanyon.net/item/techno-portfolio-management-panel/20919551 Demo: http://dacy.esy.es/eng/ Version: 1.0 Category: Webap...

Threat Outbreak Alert RuleID30894: Email Messages Distributing Malicious Software on December 1, 2017

Medium Alert ID: 56104 First Published: 2017 December 2 04:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30894 may contain the following files: Name |...

FreeBSD : cURL -- Multiple vulnerabilities (301a01b7-d50e-11e7-ac58-b499baebfeaf)

The cURL project reports : - NTLM buffer overflow via integer overflow CVE-2017-8816libcurl contains a buffer overrun flaw in the NTLM authentication code. The internal function Curlntlmcoremkntlmv2hash sums up the lengths of the user name + password = SUM and multiplies the sum by two = SIZE to...

Cisco Jabber Clients Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is du...

Lantronix Devices Detection (Telnet)

Telnet based detection of Lantronix Devices. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HackerOne: Able To Check The Exact Bounty Balance of any Bug Bounty Program

Hello HackerOne, I found a way to check the exact bounty balance of any bug bounty program. Steps To Reproduce 1. Report to any program that giving a bounty 2. Go to your Inbox 3. Open the Burp Suite before you click the report you created for your target bug bounty program. 4. Click the Intercep...

circuit-breaker.seec.com.tw XSS vulnerability

Open Bug Bounty ID: OBB-440833 Description| Value ---|--- Affected Website:| circuit-breaker.seec.com.tw Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

shop.software-partner.de XSS vulnerability

Open Bug Bounty ID: OBB-440350 Description| Value ---|--- Affected Website:| shop.software-partner.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

Wget HTTP integer overflow Exploit

Exploit for linux platform in category dos / poc wget HTTP integer overflow Exploit https://xorl.wordpress.com/2017/11/11/cve-2017-13089-wget-http-integer-overflow/ That’s an interesting vulnerability in GNU wget. According to the wget project, this was reported by Antti Levomäki, Christian Jalio...

Privilege escalation

The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free UAF vulnerability. An attacker can trick a user ...

Threat Outbreak Alert RuleID31400: Email Messages Distributing Malicious Software on November 22, 2017

Medium Alert ID: 56025 First Published: 2017 November 22 15:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31400 may contain the following files: Name |...