1066 matches found
st-line.co.jp Cross Site Scripting vulnerability OBB-1346954
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Friday Squid Blogging: Calamari vs. Squid
St. Louis Magazine answers the important question: "Is there a difference between calamari and squid?" Short answer: no. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...
CVE-2020-24034
Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...
CVE-2020-24034
CVE-2020-24034 affects Sagemcom F@ST 5280 routers running firmware version 1.150.61. The issue is an insecure deserialization in the authenticated flow that lets a logged-in user alter a serialized session cookie (sess_id, nonce, ha1) to assume another user’s role, including an internal account w...
CVE-2020-24034
Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...
Sagemcom F@ST 5280 Privilege Escalation Vulnerability
Sagemcom F@ST 5280 routers using firmware version 1.150.61, and possibly others, have an insecure deserialization vulnerability that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the...
Sagemcom F@ST 5280 Privilege Escalation
privilege escalation Date: 08-31-2020 Exploit Author: Ryan Delaney Author Contact: ryan.delaney owasp org Author LinkedIn: https://www.linkedin.com/in/infosecrd/ Vendor Homepage: https://sagemcom.com/en Software Link: N/A F@ST 5280 firmware not published Version: F@ST 5280 router, F/W 1.150.61,...
@w3sec/goof (1.1.0), door (>=0.0.5, <=0.0.6) +5 more potentially affected by CVE-2014-3744 via st (>=0.0.12, <=0.2.4)
st NPM version =0.0.12, =0.0.5, =1.0.0, =0.0.0, =0.0.0-a10, =0.1.0, =0.0.1, =0.0.12 Source cves: CVE-2014-3744 Source advisory: OSV:GHSA-69RR-WVH9-6C4Q...
Directory Traversal in st
Versions of st prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused %2e to be interpreted as . by the filesystem, resulting the potential for an attacker to read sensitive files on the server. Recommendation...
yorksj.ac.uk Cross Site Scripting vulnerability OBB-1275328
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
st-andreas.nl Cross Site Scripting vulnerability OBB-1265904
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
st-elisabeth-ac.de Cross Site Scripting vulnerability OBB-1246049
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
SQL Injection Vulnerability in ZZCMS Backend st***.php File
ZZCMS is a free website builder developed in asp language. A SQL injection vulnerability exists in the background st.php file of ZZCMS. Attackers can use the vulnerability to obtain sensitive information in the database...
st-esteve.fr Cross Site Scripting vulnerability OBB-1218248
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
homesofstjohnscounty.com Cross Site Scripting vulnerability OBB-1216622
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
st-colomban.qc.ca Cross Site Scripting vulnerability OBB-1198650
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
: Pandora FMS Community Multiple Vulnerabilities
1. Advisory Information Title : Pandora FMS Community Multiple Vulnerabilities Advisory ID : CORE-2020-0010 Advisory URL : www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities Date published : 2020-06-09 Date of last update : 2020-06-09 Vendors contacted: Ártic...
st-shika.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1182096 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
st-georgecross.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1161843 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...