CVE-2020-6095: Unchecked Return Value to NULL Pointer Dereference

An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerabili...

CVE-2020-10888

This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during...

(Pwn2Own) TP-Link Archer A7 SSH Port Forwarding Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The...

PT-2020-18920

Name of the Vulnerable Software and Affected Versions GStreamer/gst-rtsp-server version 1.14.5 Description An exploitable denial of service issue exists in the GstRTSPAuth functionality. A specially crafted RTSP setup request can cause a null pointer deference, resulting in denial-of-service. An...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability via the setup/setup-datasource-standard.jsp password parameter ...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

Design/Logic Flaw

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20526

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

CVE-2019-20525

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter...

Design/Logic Flaw

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...

CVE-2019-20527

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...

PT-2020-10502

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.1 Description The issue allows for XSS via the "setup/setup-datasource-standard.jsp" password parameter. This means an attacker could potentially inject malicious scripts into the webpage, affecting users w...

PT-2020-10503

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.1 Description The issue allows for XSS via the serverURL parameter in the "setup/setup-datasource-standard.jsp" API endpoint. This was fixed in a later version. Recommendations For Ignite Realtime Openfire...

PT-2020-10501

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.1 Description The issue allows for XSS via the "driver" parameter in the setup/setup-datasource-standard.jsp endpoint. This endpoint is used for setting up a data source. The driver parameter is vulnerable,...

CVE-2019-20526: Improper Neutralization of Input During Web Page Generation

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter...

CVE-2019-20527: Improper Neutralization of Input During Web Page Generation

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...

Easy File Sharing Web Server 7.2 Local Buffer Overflow

Exploit Title: Easy File Sharing Web Server 7.2 - SMTP 'Password' Local Buffer Overflow SEH Date: 03/16/2020 Author: Felipe Winsnes Vendor Homepage: http://www.sharing-file.com/ Software Link: http://www.sharing-file.com/download.php Version: 7.2 Tested on: Windows 7 Proof of Concept: 1.- Run the...