Cisco UCS Director default scpuser password

This module abuses a known default password on Cisco UCS Director. The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH. This module has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0. Note that Cisco also mentions in...

Firmware Slap - Discovering Vulnerabilities In Firmware Through Concolic Analysis And Function Clustering

Firmware slap combines concolic analysis with function clustering for vulnerability discovery and function similarity in firmware. Firmware slap is built as a series of libraries and exports most information as either pickles or JSON for integration with other tools. Slides from the talk can be...

PT-2019-13634 · Shapeshift · Keepkey

Name of the Vulnerable Software and Affected Versions: ShapeShift KeepKey devices affected versions not specified Description: A side channel vulnerability was discovered related to the row-based OLED display on ShapeShift KeepKey devices. The power consumption of each display cycle varies based ...

Security feature bypass

A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor versions: prior to 5.0.5.1...

k5.co.kr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-919771 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting k5.co.kr website and its user...

aea.or.kr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-909507 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting aea.or.kr website and its...

gee.gov.pt Improper Access Control vulnerability

Security Researcher Rooghz Helped patch 446 vulnerabilities Received 8 Coordinated Disclosure badges Received 31 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting gee.gov.pt website and its users. Following coordinated and...

birdeliningunlugu.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-902215 Security Researcher TusharASDAcademyKota Helped patch 5 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting birdeliningunlugu.com website and its users. Following coordinated and responsible vulnerability disclosure...

zale.se Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-897106 Security Researcher m00nr4c00n Helped patch 191 vulnerabilities Received 2 Coordinated Disclosure badges Received 2 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting zale.se website and its...

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

!/usr/bin/env python -- coding: utf-8 -- FaceSentry Access Control System 6.4.8 Remote SSH Root Access Exploit Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorith...

Chakra vulnerability debugging notes 1--ImplicitCall-vulnerability warning-the black bar safety net

Chakra is Microsoft's next-generation browser, Microsoft Edge the Javascript parsing engine, 继承自IE浏览器的jscript9.dll and on GitHub open source for ChakraCore it. Chakra since open source has become a Windows platform vulnerability discovery one of the main goals, is also everyone to learn binary...

Thunderbird ESR < 60.7.XXX - Type Confusion Vulnerability

Type confusion in Thunderbird ============================= Severity Rating: Medium Confirmed Affected Versions: All versions affected Confirmed Patched Versions: Thunderbird ESR 60.7.XXX Vendor: Thunderbird Vendor URL: https://www.thunderbird.net/ Vendor Reference:...

How I Discovered My First Vulnerability

By David Balaban I have read a couple of books recently about different vulnerabilities in order to be able to better protect my projects/websites. Today, I want to share a story about how I managed to use this knowledge in practice. Disclaimer This material is posted for educational purposes onl...

Thunderbird ESR 60.7.XXX - icalmemorystrdupanddequote Heap-Based Buffer Overflow

Thunderbird ESR 60.7.XXX - icalmemorystrdupanddequote Heap-Based Buffer Overflow X41 D-Sec GmbH Security Advisory: X41-2019-001 Heap-based buffer overflow in Thunderbird ========================================= Severity Rating: High Confirmed Affected Versions: All versions affected Confirmed...

Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow

X41 D-Sec GmbH Security Advisory: X41-2019-002 Heap-based buffer overflow in Thunderbird ========================================= Severity Rating: High Confirmed Affected Versions: All versions affected Confirmed Patched Versions: Thunderbird ESR 60.7.XXX Vendor: Thunderbird Vendor URL:...

fast2sms.com Cross Site Scripting vulnerability

Security Researcher RupeshDubey Helped patch 1 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting fast2sms.com website and its users. Following coordinated and responsible vulnerabili...

LibreNMS - addhost Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in the open source network management software known as LibreNMS. The community parameter used in a POST request to the addhost functionality is unsanitized. This parameter is later used as part of a shell command that gets passed ...

Huawei eSpace Meeting 1.1.11.103 - cenwpoll.dll SEH Buffer Overflow (Unicode)

Huawei eSpace Meeting 1.1.11.103 - cenwpoll.dll SEH Buffer Overflow Unicode !/usr/bin/env python -- coding: utf-8 -- Huawei eSpace Meeting cenwpoll.dll Unicode Stack Buffer Overflow with SEH Overwrite Vendor: Huawei Technologies Co., Ltd. Product web page: https://www.huawei.com Affected...

CyberArk Enterprise Password Vault 10.7 XML External Entity Injection

Exploit Title: CyberArk XML External Entity XXE Injection in SAML authentication Date: 10/05/2019 Exploit Author: Marcelo Toran @spamv Vendor Homepage: https://www.cyberark.com Version: =10.7 CVE : CVE-2019-7442 -----------Product description The CyberArk Enterprise Password Vault is a privileged...

Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' class MetasploitModule 'Oracle Weblogic Server Deserialization RCE - Raw Object', 'Description' = %q An unauthenticated attacker wi...