Harvest: Users enumeration is possible through cycling through recurring[client_id] argument value.

Details: An attacker can enumerate the names of companies on your site by going to the URL https://harvesterxxx.harvestapp.com/recurringinvoices/new?utf8=%E2%9C%93&recurringclientid=4677449&newclientname= and cycling through the numerical value of the recurringclientid= argument, which will view...

Technology sharing: the CBC, Padding Oracle attack re-interpretation, how to break HTTPS-bug warning-the black bar safety net

Why is a re-interpretation? Now about the Padding Oracle attack presentation, the better the articles including the content, are taken from this article in foreign languages. However, the text in the discussion a key issue of how to confirm the Padding bits, and no mention, which makes many puris...

RabbitMQ: /api/... XSS vulnerability

A cross-site scripting vulnerability was discovered in RabbitMQ, which allowed using api/ path info to inject and receive data. A remote attacker could use this flaw to create an "/api/..." URL, forcing a server error that resulted in the server returning an HTML page with embedded text from the...

RabbitMQ: /api/... XSS vulnerability

A cross-site scripting vulnerability was discovered in RabbitMQ, which allowed using api/ path info to inject and receive data. A remote attacker could use this flaw to create an "/api/..." URL, forcing a server error that resulted in the server returning an HTML page with embedded text from the...

Memory corruption

Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block SMB server error-logging action, aka "Server Message Block Memory Corruption Vulnerability."...

Hawkeye-G 3.0.1.4912 Cross Site Scripting / Information Leakage

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt Vendor: ================================ www.hexiscyber.com Product: ================================ Hawkeye-G v3.0.1.4912 Hawkeye G is an active defense...

Hawkeye-G 3.0.1.4912 - Persistent Cross-Site Scripting Information Leakage

Hawkeye-G 3.0.1.4912 - Persistent Cross-Site Scripting Information Leakage Exploit Title: Persistent XSS, Information Leakage IDS / IPS Google Dork: intitle: Persistent XSS, Information Leakage IDS / IPS Date: 2015-07-25 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor...

Hawkeye-G 3.0.1.4912 - Persistent Cross-Site Scripting / Information Leakage

Exploit Title: Persistent XSS, Information Leakage IDS / IPS Google Dork: intitle: Persistent XSS, Information Leakage IDS / IPS Date: 2015-07-25 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: www.hexiscyber.com Software Link:...

Shopify: SSRF via 'Insert Image' feature of Products/Collections/Frontpage

Hi Security team, I would like to report an another SSRF issue like my previous bug 67377 https://hackerone.com/reports/67377. The description, threats, risks, exploatations are the same. The base request is the following POST /admin/settings/files.json HTTP/1.1 Host: test-4925.myshopify.com...

Enter: Server responds with the server error logs on account creation

Impact Poorly protected response can provide a gold mine of information to an attacker, disclosing a host of sensitive information such as function and file names. This information may enable the attacker to immediately or later compromise the entire application. PoC 1. Create a new wallet. 2...

Enter: Error stack trace

Make request removed csrf token in POST data POST /settings HTTP/1.1 Host: wallet.robocoin.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:34.0 Gecko/20100101 Firefox/34.0 Accept: / Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type:...

Code injection

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 provides different web-server error codes depending on whether a requested file exists, which allows remote attackers to determine the validity of...

CVE-2014-4821

CVE-2014-4821 affects IBM WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x (up to 6.1.5.3 CF27), 7.0.x (up to 7.0.0.2 CF28), 8.0.x (up to 8.0.0.1 CF14), and 8.5.0 before CF03. The vulnerability is an information-disclosure issue where the web server returns different error codes depending o...

Localize: files likes of README.md is public

A readme or read me file contains information about other files in a directory or archive and is commonly distributed with computersoftware. Such a file is usually a text file called README.TXT, README.md, README.1ST, READ.ME, or simply README, although someMicrosoft Windows software may...

OKCupid Cross Site Scripting

Title: OKCupid Server Error Page XSS Severity: High CVE-ID: CVE-2014-3148 Re-release: 20 September 2014 Author: Kenneth F. Belva Websites: http://silverbackventuresllc.com http://xssWarrior.com http://securitymaverick.com Twitter: @infosecmaverick Contact: Please use website contact form. Mail:...

apache tomcat cookie handling problem - characters out of 0x80 - 0xff causing internal server error

Title: Client-based DoS for Apache Tomcat on sending cookie with value out of 0x80 - 0xff scope. Author: Elar Lang @elarlang https://www.linkedin.com/in/elarlang Date: 02. January 2014 / 05. September 2014 Vendor: Apache Product: Tomcat Affected versions at least: 7.0.26 7.0.39 7.0.40 Timeline: 1...

Subpages don't inherit permissions from parent pages (see comments for solution)

We are currently experiencing a serious issue with page restrictions. We have pages with restrictions, that have sub pages, which were created by users, that were deleted from the user directory in the meantime. These root-pages have read restrictions, set for a particular group. However, these s...

Subpages don't inherit permissions from parent pages (see comments for solution)

We are currently experiencing a serious issue with page restrictions. We have pages with restrictions, that have sub pages, which were created by users, that were deleted from the user directory in the meantime. These root-pages have read restrictions, set for a particular group. However, these s...

Quicktime Player <= 7.3.1.70 (rtsp) Buffer Overflow Vulnerability

No description provided by source. Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bug Author: Luigi...

XOOPS 2.0 XoopsOption Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7149/info XOOPS has been reported vulnerable to an information disclosure vulnerability. According to the report, path information and other sensitive data may be output in server error messages. Information obtained in...