442 matches found
Mail.ru: [townwars.mail.ru] Time-Based SQL Injection
Добрый день. POSТ параметры "c" и "m" названия контроллера и метода соответственно уязвимы к атаке типа SQL Injection. прямого вывода на страницу нет, но можно получить данные ориентируясь на задержку ответа от сервера если запрос возвращает false - ответ от сервера возвращается быстро. если запр...
Vimeo: All Vimeo Private videos disclosure via Authorization Bypass
Hello, There is a vulnerability in https://vimeo.com/VIDEOID?action=share that makes all Vimeo private videos available to anybody. POC link : http://opnsec.com/vimeo/vl/videoLeak.php?video=VIDEOID POC requirements : - No need to be logged in Vimeo - Because of sensitivity of this, I put a passwo...
CVE-2016-1548
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...
Updated squid packages fix security vulnerabilities
Updated squid packages fix security vulnerabilities: Due to a buffer overrun, the Squid pinger binary in Squid before 3.5.16 is vulnerable to a denial of service or information leak attack when processing ICMPv6 packets. This bug also permits the server response to manipulate other ICMP and ICMPv...
RabbitMQ: /api/... XSS vulnerability
A cross-site scripting vulnerability was discovered in RabbitMQ, which allowed using api/ path info to inject and receive data. A remote attacker could use this flaw to create an "/api/..." URL, forcing a server error that resulted in the server returning an HTML page with embedded text from the...
RTMPDump librtmp AMF3 Class Member Count Remote Code Execution Vulnerability
Talos Vulnerability Report TALOS-2016-0067 RTMPDump librtmp AMF3 Class Member Count Remote Code Execution Vulnerability January 7, 2016 CVE Number CVE-2015-8271 Description The vulnerability occurs within the AMF3CDAddProp function within amf.c. If an attacker sets up a malicious RTMP Media serve...
HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports
Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...
Google Golang Go HTTP Header Injection Vulnerability
Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. An HTTP header injection vulnerability exists in Google Golang Go. An attacker can exploit this vulnerability to inject arbitrary HTTP headers into the server response, bypass...
Net-SNMP memory corruption
Memory corruption on server response parsing...
Apache Tomcat JK Connector 1.2.x < 1.2.41 JkUnmount Directive Handling Remote Information Disclosure
Based on the Server response header, the installation of the JK Connector modjk in Apache Tomcat listening on the remote host is version 1.2.x prior to 1.2.41. It is, therefore, affected by an information disclosure vulnerability due to improper handling of the 'JkUnmount' directive and multiple,...
Enter: Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"
Issue It is possible to set negative values for the Buy Fee and Sell Fee, which will cause unexpected transfers etc. as these settings override the settings at the location. PoC 1. Go to the Operator Wallet's Settings. 2. Click on the users tab. 3. Select any user. 4. Go to settings tab of that...
FreeRDP integer overflow
Integer overflow on server response parsing...
FreeBSd ftp code execution
Shell characters vulnerability on server response parsing...
Twitter's latest exploit: a hacker can traverse account delete credit card-vulnerability warning-the black bar safety net
Just this month beginning of the month, with other social networks, twitter also started a new vulnerability reward program, bonus reached$1 4 0+/vulnerabilities, you can say the reward is still very lucrative. Compared to our domestic manufacturers to say, I personally think that this is a netwo...
dhcpcd DoS
Infinite loop on server response parsing...
Trillian 0.x IRC Module Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5373/info A buffer overflow condition has been reported in the Trillian IRC module. The condition is due to insecure handling of data extracted from server responses. An attacker in control of a malicious server may explo...
Xlink FTP Client Buffer Overflow
No description provided by source. $Id: xlinkclient.rb 10998 2010-11-11 22:43:22Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
MyBulletinBoard (MyBB) <= 1.2.3 - Remote Code Execution Exploit
No description provided by source. !/usr/bin/php ?php errorreportingEALL ^ ENOTICE; http://www.milw0rm.com/exploits/2012 They corrected not all a lot of SQL requests which use the ipaddress, with $db-escapestring. They don't corrected the function this is a choice ... the bad and they forgot to...
Microsoft Internet Explorer 5/6 Object Type Validation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8456/info The problem occurs when Internet Explorer receives a response from the server when a web page containing an object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to b...
Apple QuickTime 5.0 Content-Type Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4064/info Apple QuickTime is a freely available media player. It runs on a number of platforms including MacOS and Windows 9x/ME/NT/2000/XP operating systems. Apple QuickTime For Windows does not perform sufficient bounds...