CVE-2018-10240

SolarWinds Serv-U MFT before 15.1.6 HFv1 uses low-entropy session tokens assigned to authenticated users, which can be included as a URL parameter in lieu of a session cookie. An attacker can brute-force the token to obtain the corresponding session cookie and hijack the user’s session. Reported ...

u-g.lt XSS vulnerability

Open Bug Bounty ID: OBB-614538 Description| Value ---|--- Affected Website:| u-g.lt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

magasins-u.com XSS vulnerability

Open Bug Bounty ID: OBB-576822 Description| Value ---|--- Affected Website:| magasins-u.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

u-stat.net XSS vulnerability

Open Bug Bounty ID: OBB-457270 Description| Value ---|--- Affected Website:| u-stat.net Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2017-5090

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar problem 32458012...

u-hope.net IFRAME Injection vulnerability

Vulnerable URL: http://www.u-hope.net/productsindex.php?id=-14%27%3E%3Ciframe%20src=%22http://openbugbounty.org%22%20width=%22450%22%20height=%22200%22%3E%3C/iframe%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| IFRAME Injection Vulnerability status:| Publicly...

Apple co-founder Steve Wozniak Launches ‘Woz U’ Online Tech Education Platform

By Waqas Steve Wozniak nicknamed The Woz known as a coding genius and This is a post from HackRead.com Read the original post: Apple co-founder Steve Wozniak Launches Woz U Online Tech Education Platform...

u-server.jp Open Redirect vulnerability

Vulnerable URL: http://www.u-server.jp/redirect.php?action=url=www.openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 01.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 4014226 VIP website status:| No...

BSA-2017-444

Security Advisory ID : BSA-2017-444 Component : DENX Das U-Boot Revision : 3.0: Final Das U-Boot is a devicebootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper...

BSA-2017-445

Security Advisory ID : BSA-2017-445 Component : DENX Das U-Boot Revision : 3.0: Final Das U-Boot is a devicebootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper...

u-picardie.fr XSS vulnerability

Open Bug Bounty ID: OBB-292806 Description| Value ---|--- Affected Website:| u-picardie.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

Overview Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying...

Arris NVG589 and NVG599 AT&T U-verse Authentication Vulnerabilities

The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit this vulnerability ...

Arris NVG589 and NVG599 AT&T U-verse Information Disclosure Vulnerabilities

The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit the vulnerability t...

Design/Logic Flaw

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...

CVE-2017-14117

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Design/Logic Flaw

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH logins to the remotessh account with the 5SaP9I26 password, which allows remote attackers to access a "Terminal shell v1.0" service, and...

CVE-2017-14117

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...