4690 matches found
cURL -- TLS session resumption client cert bypass (again)
cURL security advisory: libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the...
ESKIMOROLL-ms14-068 Windows vulnerability in the Key Distribution Center (KDC) service (CVE-2014-6324)
Description MS14-068 is a Windows vulnerability in the Key Distribution Center KDC service. It allows an authenticated user to insert an arbitrary PAC a structure that represent all user rights in its Kerberos ticket the TGT. https://technet.microsoft.com/library/security/ms14-068.aspx In Windows...
Cross-Site Scripting
Overview Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as...
BEST Mumbai Bus Ticket & Pass - Customized SSL, Exported ContentProvider, Hardcoded secrets vulnerabilities
HackApp vulnerability scanner discovered that application BEST Mumbai Bus Ticket & Pass published at the 'play' market has multiple vulnerabilities...
Gratipay: Content-Length restriction bypass to heap overflow in gip.rocks.
I started playing around with a0xnirudh's Content-Length restriction bypass and noticed that when combined with a different vulnerability this could be leveraged to do a bit more than DoS. We decided to open a new ticket to address this issue, since we were already aware of the bypass. a0xnirudh...
CVE-2015-3883
Multiple cross-site scripting XSS vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the 1 searchkeywords parameter to index.php/users page; the 2 "Name of application" on index.php/configuration; 3 a new project name on index.php/projects; 4 the task na...
CVE-2017-5621
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API...
Responsive Events Movie Ticket Booking Script - SQL Injection
Responsive Events Movie Ticket Booking Script - SQL Injection Exploit Title: Responsive Events & Movie Ticket Booking Script - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software :...
How to Import NetScaler exported configuration: File-Introduction and Requirements?
With StoreFront 3.7, we introduced the ability to import an exported configuration from NetScaler Gateway. With the introduction of this feature, we enhance the capabilities previously available by allowing multiple vServers to be imported from a single configuration file. The Remote access...
DEBIAN-CVE-2016-9139
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...
CVE-2016-9139
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...
CVE-2016-9139
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...
UBUNTU-CVE-2016-9139
Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...
CVE-2016-9139
Removed by vendor...
F5 TLS Session Ticket Implementation Remote Memory Disclosure (Ticketbleed) (uncredentialed check)
Based on its response to a resumed TLS connection, the remote service appears to be affected by an information disclosure vulnerability, known as Ticketbeed, in the TLS Session Ticket implementation. The issue is due to the server incorrectly echoing back 32 bytes of memory, even if the Session I...
MS14-068-domain privilege escalation vulnerability summary-vulnerability warning-the black bar safety net
0x01 vulnerability of origin Said to ms14-068,have to say the silver ticket, that is, the cheque in. Cheque is a piece of tgs, that is, a service Ticket. The service ticket is the client is sent directly to the server and request the service resource. If the server is not the domain controller dc...
Joomla JE Ticket System 1.2 SQL Injection
Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/help-desk/je-ticket-syste...
Joomla JE Ticket System 1.2 SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...
ticket.kutxabank.es XSS vulnerability
Vulnerable URL: https://ticket.kutxabank.es/janto/main.php?Nivel=Evento\"-confirmOPENBUGBOUNTY//=170219MUSIK Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...
Joomla! Component JE Ticket System 1.2 - SQL Injection
Exploit Title: Joomla! Component JE Ticket System v1.2 - SQL Injection Google Dork: inurl:index.php?option=comjeticket Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/help-desk/je-ticket-syste...