CellPipe 7130 Cross Site Request Forgery

CellPipe Router CSRF vulnerability Device model : CellPipe 7130 RG 5Ae. M2013 HOL Software Version: : 1.0.0.20h.HOL CWE: 352 - https://cwe.mitre.org/data/definitions/352.html CVE: CVE-2015-4586 Date: 16/06/2015 Discovered by: Dionisia Lerataki https://gr.linkedin.com/pub/dionisia-lerataki/88/18/8...

DreamBox DM500s Cross Site Scripting

DreamBox DM500s Reflected XSS Vendor: Dream Multimedia GmbH Product web page: http://www.dream-multimedia-tv.de Summary: The Dreambox DM500s is a Linux-powered DVB satellite, terrestrial and cable digital television receivers set-top box. Tested on: Linux Kernel 2.6.9, The Gemini Project, Enigma...

CVE-2015-2999

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

AsHttp - Shell Command to Expose any other Command as HTTP

ashttp provide a simple way to expose any shell command by HTTP. For example, to expose top by HTTP, try : ashttp -p8080 top ; then try http://localhost:8080. Dependencies ashttp depends on hlvt100, a headless VT100 emulator. To get and compile hlvt100 : $ git clone...

Sendio ESP - Information Disclosure

Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of last update: 2015-05-22 Vendors contacted: Sendio...

CVE-2015-2165

Multiple cross-site scripting XSS vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform MSDP 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the 1 portal, 2 fromDate, 3 toDate, 4 fromTime, 5 toTime, 6 kword, 7 uname, 8 pname, 9...

PT-2015-5637

Name of the Vulnerable Software and Affected Versions Ericsson Drutt Mobile Service Delivery Platform MSDP versions 4.x through 6.x Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Report Viewer of Ericsson Drutt Mobile Service Delivery Platform MSDP. These...

kampung-sungai-ular.malaysia.topdestination.fr XSS vulnerability

Open Bug Bounty ID: OBB-56169 Description| Value ---|--- Affected Website:| kampung-sungai-ular.malaysia.topdestination.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:...

Flash patch is released for four years, a vulnerability is still a vulnerability-vulnerability warning-the black bar safety net

Early in the 2 0 1 1 year Adobe Flash will released a security vulnerability patch still fails to work, today an attacker can still exploit the vulnerability to attack, Alexa rank of the top ten popular websites in the three are affected by the vulnerability. Vulnerability description LinkedIn...

PT-2015-5374

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.19.1 Description The issue is related to the stack randomization feature in the Linux kernel, which uses incorrect data types for the results of bitwise left-shift operations. This makes it easier for attackers...

X (Formerly Twitter): Insecure Data Storage in Vine Android App

Hi Twitter, - Vulnerability Class:OWASP M2 : Insecure Data Storage Every application needs to store something secret, like a website username,password, cookies etc. , internal storage is the place to do it, android sandbox prevents other applications from accessing this data but,In vine android a...

PT-2015-3472

Name of the Vulnerable Software and Affected Versions SweetRice CMS versions prior to 0.6.7.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a top height cookie. Recommendations Fo...

CVE-2014-8732

CVE-2014-8732 CVSSv2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:H/RL:U/RC:C CVSSv2 Base Score=7.5 CVSSv2 Temp Score=7.5 OWASP Top 10 classification: A3 - Cross Site Scripting There is a stored xss vulnerability in phpMemcachedAdmin. Most of the user-specified input fields which are displayed on several...

CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2

CVE-2014-8731 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C CVSSv2 Base Score=10.0 CVSSv2 Temp Score=9.5 OWASP Top 10 classification: A1 - Injection PHPMemcachedAdmin is a web-based frontend for Linux's memcached Daemon. Project Homepage: https://code.google.com/p/phpmemcacheadmin/...

DEBIAN-CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

Design/Logic Flaw

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

PHPMemcachedAdmin 1.2.2 Remote Code Execution Vulnerability

PHPMemcachedAdmin versions 1.2.2 and below suffer from a remote code execution vulnerability. CVE-2014-8731 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C CVSSv2 Base Score=10.0 CVSSv2 Temp Score=9.5 OWASP Top 10 classification: A1 - Injection PHPMemcachedAdmin is a web-based frontend fo...

Darkhotel APT Group Targeting Top Executives in Long-Term Campaign

APT groups tend to be grouped together in a large amorphous blob of sinister intentions and similar targets, but not all APT crews are created equal. Researchers have identified a group that’s been operating in Asia for at least seven years and has been using hotel networks as key infection point...

CVE-2014-7802

The CVE-2014-7802 entry concerns the Top Roller Coasters Europe 2 Android app (com.appaapps.top10tallesteuropeanrollercoasters2). The vulnerability is due to the app not validating X.509 certificates from SSL servers, which allows MITM attackers to spoof servers and obtain sensitive information v...

PT-2014-8284

Name of the Vulnerable Software and Affected Versions The Top Roller Coasters Europe 2 aka com.appaapps.top10tallesteuropeanrollercoasters2 version @7F050001 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and...