Faraday v2.5 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

evertoncollection.org.uk XSS vulnerability

Vulnerable URL: http://www.evertoncollection.org.uk/search/results?q==" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5101299 VIP website status:| No Check evertoncollection.org.u...

CVE-2016-9830

The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service crash via large dimensions in a jpeg image...

Netgear DGN2200 dnslookup.cgi Command Injection

This module exploits a command injection vulnerablity in NETGEAR DGN2200v1/v2/v3/v4 routers by sending a specially crafted post request with valid login details. Module Options msf use exploit/linux/http/netgear/dnslookupcmdexec msf undefineddnslookupcmdexec show actions ...actions... msf...

pornfilms3d.com XSS vulnerability

Vulnerable URL: http://pornfilms3d.com/tour2/?nats=%22%3E%3Cimg%20src=x%20onerror=prompt%27OPENBUGBOUNTY%27;%3EMTA3ODc6NzoyNQ,0,0,0,0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

earncashmoney.com Open Redirect vulnerability

Vulnerable URL: http://www.earncashmoney.com/goto/http://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

VK.com: HTML Injection possible due to bad filter

Hello, I have found an area where it may be possible to run certain HTML/JS scripts. TO REPRODUCE: 1. Go to documents 2. Upload anything and edit it 3. On the edit page in tags, enter code without a closing bracket ex. img src=x 4. Click enter 5. It will be parsed in that area, but after saving i...

Ruby on Rails Dynamic Render File Upload Remote Code Execution

require 'msf/core' class MetasploitModule 'Ruby on Rails Dynamic Render File Upload Remote Code Execution', 'Description' = %q This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple...

chicagofaucets.info XSS vulnerability

Open Bug Bounty ID: OBB-181020 Description| Value ---|--- Affected Website:| chicagofaucets.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

F5 Networks BIG-IP : Apache Axis vulnerability (SOL16821)

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subjec...

avalonsales.com XSS vulnerability

Vulnerable URL: http://avalonsales.com/sales/results.php?town=%22%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E%22 Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:08 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

GLSA-201607-01 : Squid: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201607-01 Squid: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Squid. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a...

Phoenix Exploit Kit - Remote Code Execution

Exploit for php platform in category web applications Exploit Title: Phoenix Exploit Kit - Remote Code Execution Exploit Author: CrashBandicot @DosPerl Tested on: MSWin32 Vuln file : geoip.php 492. isset$GET'bdr' ? eval$GET'bdr' : explode'nop','nop nop nop'; PoC :...

finchfuneralchapels.com XSS vulnerability

Vulnerable URL: http://www.finchfuneralchapels.com/runtime.php?NavigatorId=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6488998 VIP website status:| No Check...

VulnCheck KEV: CVE-2017-0144

The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets...

ATutor LMS - install_modules.php Cross-Site Request Forgery Remote Code Execution

ATutor LMS - installmodules.php Cross-Site Request Forgery Remote Code Execution / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/20...

liar.net XSS vulnerability

Vulnerable URL: http://liar.net/?domain=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 02.03.2016 Latest check for patch:| 02.03.2016 23:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

radusa.com XSS vulnerability

Vulnerable URL: http://www.radusa.com/3-11172/Search/?q=%22%2F%3E%3CscRiPT%3Ealert%28%22XSSPOSED%22%29%3B%3C%2FscriPT%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2685491 Goog...

volare.com XSS vulnerability

Vulnerable URL: http://www.volare.com/?notfound=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 22.02.2016 Latest check for patch:| 22.02.2016 12:47 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

massmind.org XSS vulnerability

Vulnerable URL: http://www.massmind.org/techref/ipdisplay.asp?ip=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2033251 Google Pageran...