libssh -- Unsanitized location in scp could lead to unwanted command execution

The libssh team reports: In an environment where a user is only allowed to copy files and not to execute applications, it would be possible to pass a location which contains commands to be executed in additon. When the libssh SCP client connects to a server, the scp command, which includes a...

Asset Discover - Burp Suite Extension To Discover Assets From HTTP Response

Burp Suite extension to discover assets from HTTP response using passive scanning. Refer our blog Asset Discovery using Burp Suite for more details. The extension is now part of the BApp store and can be installed directly from the Burp Suite...

Bematech Printer MP-4200 Cross Site Scripting / Denial Of Service

Exploit Title: Bematech Printer MP-4200 - Denial of Service Date: 2019-11-11 Exploit Author: Jonatas Fil Vendor Homepage: https://www.bematech.com.br/ Software Link: https://www.bematech.com.br/produto/mp-4200-th/ Version: MP-4200 TH Tested on: Windows and Linux CVE : N/A DoS Poc:...

eMerge50P 5000P 4.6.07 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: eMerge50P 5000P 4.6.07 - Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 4.6.07...

Microsoft Windows Graphics Device Interface Information Disclosure (CVE-2019-0802)

An information disclosure vulnerability exists in Microsoft Graphics Device Interface of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. Successful exploitation could result in disclosure of information which could be used to further compromise the target...

Capesand Exploit Kit Landing Page

Capesand exploit kit is a web exploit kit that operates by delivering malicious payload to the victim's computer. Successful infection will allow the attacker to download additional malware to the target...

CVE-2014-9013

The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmpppajaxcall with an execution target of wpinsertuser...

Microsoft Windows Graphics Device Interface Information Disclosure (CVE-2019-0961)

An information disclosure vulnerability exists in Microsoft Graphics Device Interface of Microsoft Windows. The vulnerability is due to improper handling of objects in memory. Successful exploitation could result in disclosure of information which could be used to further compromise the target...

thrsrossi Millhouse-Project 1.414 Cross Site Scripting

Exploit Title: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting Date: 2019-11-01 Exploit Author: Cakes Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project Software Link: https://github.com/thrsrossi/Millhouse-Project.git Version: 1.414 Tested on: CentOS 7...

Reverse Tabnabbing

Overview Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks. Recommendation Upgrade to version 1.9...

PVS 7.15: Unable to boot/restart target device from PVS

Nothing happens when weboot/restart target device from PVS console. Able to boot/restart machine from Studio...

Win10 MailCarrier 2.51 - POP3 User Remote Buffer Overflow

Win10 MailCarrier 2.51 - POP3 User Remote Buffer Overflow Exploit Title: Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow Date: 2019-10-01 Author: Lance Biggerstaff Original Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://www.tabslab.com/ Version: 2.51 Tested...

Medium: openssh

Issue Overview: An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being...

The vulnerability of the Windows Error Reporting service in Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the Windows Error Reporting service in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges by deleting the target file...

Oracle VirtualBox VMSVGA Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2019-12290

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the...

Bolt CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-36972)

Bolt CMS is a PHP-based open source content management system for the Bolt community. Bolt CMS cross-site request forgery vulnerability, an attacker can exploit the vulnerability in the user has logged into the target site , to induce the user to visit an attack page , to take advantage of the...

netaddr world-writeable file permissions

The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

bootstrap: XSS in the data-target attribute

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041...