Exif-Gps-Tracer - A Python Script Which Allows You To Parse GeoLocation Data From Your Image Files Stored In A dataset

A python script which allows you to parse GeoLocation data from your Image files stored in a dataset.It also produces output in CSV file and also in HTML Google Maps Prerequisite To run this script fluently , 1 You should have Google Maps API 2 You should enable Map JavaScript API in Console To g...

Formstone 跨站脚本漏洞

Formstone is a front-end component codebase from the Formstone team. Formstone has a security vulnerability in version 1.4.16 and earlier caused by a failure to properly validate user-supplied input in the -target.php and upload-block.php folder in an upload. A remote attacker can exploit this...

MikroTik RouterOS Cross-Site Scripting Vulnerability (CNVD-2021-01532)

MikroTik RouterOS is the operating system for the MikroTik RouterBOARD hardware. A reflected cross-site scripting vulnerability exists in the hotspot login page in MikroTik RouterOS 2021-01-04 and earlier. An attacker can exploit this vulnerability via the target parameter to conduct a cross-site...

CVE-2021-3014

In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter...

Knockpy 4.1.1 CSV Injection

Exploit Title: Knockpy 4.1.1 - CSV Injection Author: Dolev Farhi Date: 2020-12-29 Vendor Homepage: https://github.com/guelfoweb/knock Version : 4.1.1 Tested on: Debian 9.13 Knockpy, as part of its subdomain brute forcing flow of a remote domain, issues a HEAD request to the server to fetch detail...

Mikrotik MikroTik RouterOS 跨站脚本漏洞

MikroTik RouterOS is the operating system for the MikroTik RouterBOARD hardware. A reflected cross-site scripting vulnerability exists in the hotspot login page in MikroTik RouterOS 2021-01-04 and earlier. An attacker can exploit this vulnerability via the target parameter to conduct a cross-site...

Citrix Provisioning Services Boot Degradation With Cylance Protect

1. Target Device TD boot times increase when Cylance Protect 2.1 is installed within the vDisk. The boot delay is after the OS has been delivered to the Target Device and is now resident in RAM. This is after our Target has transitioned from Single IO to Multi IO mode in a BIOS based TD...

Web Servers Memory Corruption Attempt (CVE-2020-12000; CVE-2020-13934; CVE-2020-3239; CVE-2020-9490)

A memory corruption vulnerability can be exploited by malicious actors. Successful exploitation could cause damage to target systems...

Input validation

There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this...

CVE-2020-9200

There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this...

h1-ctf: Invading Grinch Network and Saving Christmas

How we saved Christmas As usual with H1 CTF challenges we are provided with a target URL. In our case it is the following: https://hackyholidays.h1ctf.com/ We started by visiting the URL and see what is going on. All we could see is a page with an image with a warning message. F1125722 We quickly...

CentOS: Security Advisory for python-rtslib (CESA-2020:5435)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

bootstrap: XSS in the data-target attribute

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

Oracle Linux 7 : python-rtslib (ELSA-2020-5435)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5435 advisory. 2.1.74-1.0.1 - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix Orabug: 27613482 - Add patch 0004-allow-underscore-in-oracle-iqns to fix Orabug: 27582660 -...

targetcli: weak permissions for /etc/target and backup files

An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highe...

Microsoft Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A remote code execution vulnerability exists in Microsoft Visual Studio. An attacker could exploit t...

Microsoft Visual Studio Code Execution Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle.Git for Visual Studio is one of the Git Distributed Version Control Git for Visual Studio i...

Code injection

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafti...

Huawei Multiple Products Command Injection Vulnerability

Huawei B2368-22 and others are a high-performance outdoor CPE terminal from Huawei China. a command injection vulnerability exists in several Huawei products, which can be exploited by attackers to inject commands on the target device...