Thrive Smart Home v1.1 Reflected Cross-Site Scripting

Summary As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options available to give your home a high-tech makeover. If the convenience of feeding your cat or turning on your air conditioning with a tap on your...

celetrocaxias.com.br Cross Site Scripting vulnerability

Security Researcher KhanJanny Helped patch 2643 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting celetrocaxias.com.br website and its users. Following...

Telerik UI - Remote Code Execution via Insecure Deserialization Exploit

Exploit for asp platform in category web applications Telerik UI - Remote Code Execution via Insecure Deserialization Exploit See the full write-up at Bishop Fox, CVE-2019-18935: https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui, for a complete walkthrough of...

Zendesk SweetHawk Survey 1.6 Cross Site Scripting

Exploit Title: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Date: 2019-12-17 Exploit Author: MTK Vendor Homepage: https://sweethawk.co/zendesk/survey-app Software Link: https://www.zendesk.com/apps/support/survey/ Version: Up to v1.6 Tested on: Zendesk - Firefox/Windows...

him.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1040459 Security Researcher Sidd Helped patch 16 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting him.de website and its users. Following coordinated and...

OpenNetAdmin 18.1.1 - Command Injection Exploit #RCE

Exploit for php platform in category web applications class MetasploitModule 'OpenNetAdmin Ping Command Injection', 'Description' = %q This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1. , 'Author' = 'mattpascoe', Vulnerability discovery 'Onur ER ' Metasploit modul...

OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)

OpenNetAdmin 18.1.1 - Command Injection Exploit Metasploit class MetasploitModule 'OpenNetAdmin Ping Command Injection', 'Description' = %q This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1. , 'Author' = 'mattpascoe', Vulnerability discovery 'Onur ER ' Metasploit...

OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)

class MetasploitModule 'OpenNetAdmin Ping Command Injection', 'Description' = %q This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1. , 'Author' = 'mattpascoe', Vulnerability discovery 'Onur ER ' Metasploit module , 'References' = 'EDB', '47691' , 'DisclosureDate' =...

oechsle.tv Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1034361 Security Researcher devl00p Helped patch 3000 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting oechsle.tv website and i...

newhols.com Cross Site Scripting vulnerability

Security Researcher Cyberaj Helped patch 3 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting newhols.com website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty ha...

Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions Vulnerability

Exploit Title: Max Secure Anti Virus Plus 19.0.4.020 - Insecure File Permissions Discovery by: hyp3rlinx Vendor Homepage: www.maxpcsecure.com Tested Version: 19.0.4.020 CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

NSAuditor 3.1.8.0 Key Denial Of Service

Exploit Title: Nsauditor 3.1.8.0 - 'Key' Denial of Service PoC Discovery by: SajjadBnd Date: 2019-11-30 Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/nsauditorsetup.exe Tested Version: 3.1.8.0 Vulnerability Type: Denial of Service DoS Local Tested on...

catforth.lancsngfl.ac.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1025057 Security Researcher devl00p Helped patch 2974 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting catforth.lancsngfl.ac.uk...

QNAP QTS and Photo Station Local File Inclusion

This module exploits a local file inclusion in QNAP QTS and Photo Station that allows an unauthenticated attacker to download files from the QNAP filesystem. Because the HTTP server runs as root, it is possible to access sensitive files, such as SSH private keys and password hashes. This module h...

coburn.msdpt.k12.in.us Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1020255 Security Researcher Gh05tPT Helped patch 6889 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting coburn.msdpt.k12.in.us...

ipPulse 1.92 - Enter Key Denial of Service (PoC)

ipPulse 1.92 - Enter Key Denial of Service PoC Exploit Title: ipPulse 1.92 - 'Enter Key' Denial of Service PoC Discovery by: Diego Buztamante Discovery Date: 2019-11-18 Vendor Homepage: https://www.netscantools.com/ippulseinfo.html Software Link : http://download.netscantools.com/ipls192.zip Test...

nsh.getresponse.co.in Open Redirect vulnerability

Open Bug Bounty ID: OBB-1015550 Security Researcher 41PH4 Helped patch 18 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting nsh.getresponse.co.in website and its users. Following...

Technicolor TD5130.2 - Remote Command Execution

Technicolor TD5130.2 - Remote Command Execution Exploit Title: Technicolor TD5130.2 - Remote Command Execution Date: 2019-11-12 Exploit Author: João Teles Vendor Homepage: https://www.technicolor.com/ Version: TD5130v2 Firmware Version: OIFwV20 CVE : CVE-2019-18396 --------------------------- POS...

Pwning a Smart Car Charger, Building a Botnet

…or Why We Don’t Build Commercial IoT on a Raspberry Pi. A positive story of disclosure and remediation. We’re quite into our electric vehicles at PTP, so we started hunting for a smart car charger. There are plenty of industrial chargers out there and some research has been done in the past. We...

Smartwares HOME easy v1.0.9 Database Backup Information Disclosure Exploit

Summary Home Easy/Smartwares are a range of products designed to remotely control your home using wireless technology. Home Easy/Smartwares is very simple to set up and allows you to operate your electrical equipment like lighting, appliances, heating etc. Description The home automation solution...