CVE-2016-4707

CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitrary users via unspecified vectors...

LocalTapiola: Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)

Issue The reporter found several severe and highly critical issues in the Oracle Webcenter Sites affecting www.lahitapiola.fi. The reporter used publicly available information for finding out information relevant to performing the research. Default installation paths, URL's and privileged usernam...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.50.3-i586-1slack14.2.txz: Upgraded. Fixed heap overflows in four libcurl functions: curlescape,...

Exper EWM-01 ADSL/MODEM - Unauthenticated DNS Change

Exploit for cgi platform in category web applications !/bin/bash Exper EWM-01 ADSL/MODEM Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, whic...

Inteno EG101R1 VoIP Router - DNS Change

Inteno EG101R1 VoIP Router - DNS Change !/bin/bash Inteno EG101R1 VoIP Router Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is...

Tenda ADSL2/2+ Modem 963281TAN Unauthenticated Remote DNS Changer

!/bin/bash Tenda ADSL2/2+ Modem 963281TAN Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible without authentication. Once...

PIKATEL 96338WS_ 96338L-2M-8M - DNS Change

PIKATEL 96338WS 96338L-2M-8M - DNS Change !/bin/bash PIKATEL 96338WS, 96338L-2M-8M Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is...

COMTREND ADSL Router CT-5367 C01_R12 / CT-5624 C01_R03 - DNS Change

!/bin/bash COMTREND ADSL Router CT-5367 C01R12, CT-5624 C01R03 Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible without...

Inteno EG101R1 VoIP Router - DNS Change

!/bin/bash Inteno EG101R1 VoIP Router Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible without authentication. Once...

PT-2016-2746

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge Description The issue allows remote attackers to obtain sensitive information via a crafted web site. This is due to the way the affected components handle objects in memory, whi...

ASUS DSL-X11 ADSL Router - DNS Change

ASUS DSL-X11 ADSL Router - DNS Change !/bin/bash ASUS DSL-X11 ADSL Router Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible...

COMTREND ADSL Router CT-5367 C01_R12 CT-5624 C01_R03 - DNS Change

COMTREND ADSL Router CT-5367 C01R12 CT-5624 C01R03 - DNS Change !/bin/bash COMTREND ADSL Router CT-5367 C01R12, CT-5624 C01R03 Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The...

PLANET VDR-300NU ADSL Router - Unauthenticated DNS Change

Exploit for cgi platform in category web applications !/bin/bash PLANET VDR-300NU ADSL ROUTER Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface,...

Exper EWM-01 ADSL/MODEM Unauthenticated Remote DNS Changer

!/bin/bash Exper EWM-01 ADSL/MODEM Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface, which is accessible without authentication. Once modified,...

CVE-2016-5162

The AllowCrossRendererResourceLoad function in extensions/browser/urlrequestutil.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json webaccessibleresources field for restrictions on IFRAME elements, which...

Safari < 9.1 Multiple Vulnerabilities

Binary data 9396.prm...

LocalTapiola: Oracle WebCenter Sites Support Tools available and Information disclosure (/cs/Satellite)

Oracle WebCenter Sites Support Tools are available in: www.lahitapiola.fi This software is password protected, but some pages are publicly available and reveal internal information. The welcome page is located at: http://www.lahitapiola.fi/henkilo?pagename=Support/Home This page reveal data as th...

TYPO3 Backend Subcomponent Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 Backend Subcomponent. Because the program fails to properly filter user-supplied input, an attacker may be able to exploit the vulnerability to...

Pokémon GO Spam, Ransomware, On the Rise

It didn’t take long for attackers to start capitalizing on the popularity of Pokémon GO. Shortly after Niantic, the company behind the now ubiquitous app, released it last month, researchers spotted a malicious, backdoored version of the app on a file repository service. Now attackers are pushing...

GitLab: XSS On meta tags in profile page

The profile page https://gitlab.com/u/ does not properly sanitize quotation marks, allowing for injection of attributes into the meta tags. This allows for redirection to phishing sites and other various nefarious things. I've managed to get my profile page to redirect to Bing by setting my bio t...