15713 matches found
CVE-2020-4522
IBM Jazz Team Server based Applications are affected by a cross-site scripting vulnerability (CVE-2020-4522) in the Web UI, potentially enabling an attacker to inject arbitrary JavaScript and cause credentials disclosure within a trusted session. Affected products include IBM Engineering DOORS Ne...
CVE-2020-4445
CVE-2020-4445 affects IBM Jazz Team Server based applications with a cross-site scripting vulnerability in the WEB UI. The issue enables embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. The vulnerability is identified across mult...
CVE-2020-4522
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182397...
pixiv: Open Redirect at https://oauth.secure.pixiv.net
Summary: Hello @pixiv security team, i hope you are well, i noticed you can redirect users to another domain if you send an invalided scope. Vulnerable Url...
WordPress SRS Simple Hits Counter SQL Injection
SQL Injection vulnerability in SRS Simple Hits Counter postid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
Security Bulletin: Multiple vulnerabilities affects IBM Jazz Foundation and IBM Engineering products.
Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Lifecycle Optimization - Engineeri...
CVE-2020-2249
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...
CVE-2020-2249
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system...
CVE-2020-2249
CVE-2020-2249 affects Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier, where a webhook secret is stored unencrypted in the plugin’s global configuration file (hudson.plugins.tfs.TeamPluginGlobalConfig.xml) on the Jenkins controller file system. This allows attackers with local ...
Pocsuite
This is an offensive tool for vulnerability exploitation. It is a Python-based framework for developing and executing proof-of-concept PoC exploits, primarily targeting web applications. The framework, known as Pocsuite, is designed to simplify the process of creating and executing exploits, maki...
PT-2020-15473 · Jenkins · Jenkins Team Foundation Server Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Team Foundation Server Plugin versions 5.157.1 and earlier Description: The issue concerns the storage of a webhook secret in an unencrypted form within the global configuration file on the Jenkins controller. Specifically, the secret...
DVS - D(COM) V(ulnerability) S(canner) AKA Devious Swiss Army Knife
Did you ever wonder how you can move laterally through internal networks? or interact with remote machines without alerting EDRs? Let's assume that we have a valid credentials, or an active session with access to a remote machine, but we are without an option for executing a process remotely in a...
MikroTik RouterOS Memory Corruption / NULL Pointer Dereference Vulnerbilities
MikroTik RouterOS suffers from NULL pointer dereference, memory corruption and division by zero vulnerabilities. Advisory: three vulnerabilities found in MikroTik's RouterOS Details ======= MikroTik RouterOS Memory Corruption / NULL Pointer Dereference Vulnerbilities Product: MikroTik's RouterOS...
team-time.net Cross Site Scripting vulnerability OBB-1284021
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Oracle E-Business File Disclosure
File disclosure vulnerability in Oracle E-Business bscpgraph.jsp Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
Cross Site Scripting and RCE in baserCMS
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS and Remote Code Execution RCE. Impact: XSS to RCE via Arbitrary file upload. Attack vector is: Administrator must be logged in. Components are: ThemeFilesController.php, UploaderFilesController.php. Tested baserCMS Version : 4.3.6...
Nagios Log Server 2.1.6 Cross Site Scripting
Exploit Title: Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting Date: 2020-08-07 Vendor Homepage: https://www.nagios.com/products/nagios-log-server/ Vendor Changelog: https://www.nagios.com/downloads/nagios-log-server/change-log/ Exploit Author: Jinson Varghese Behanan @JinsonCyberSec...
CVE-2020-23973
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter...
Hack-Tools - The All-In-One Red Team Extension For Web Pentester
The all-in-oneRed Team browser extension for Web Pentesters HackTools, is a web extension facilitating your web application penetration tests , it includes cheat sheets as well as all the tools used during a test such as XSS payloads, Reverse shells and much more. With the extension you no longer...
A Vulnerability Disclosure Program is not just a page on a web site
It’s great to see an increasing number of organisations starting down the path of a Vulnerability Disclosure Program or ‘VDP,’ but it increasingly strikes me that these are ‘check box’ exercises rather than a genuine desire to interact positively with researchers and improve security. A VDP is a...