web.jinfo.com XSS vulnerability

Open Bug Bounty ID: OBB-551446 Description| Value ---|--- Affected Website:| web.jinfo.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based...

2017 OWASP Top 10: The Good, the Bad and the Ugly

Since its founding in 2001, the Open Web Application Security Project OWASP has become a leading resource for online security best practices. In particular, its list of the top 10 “Most Critical Web Application Security Risks” is a de facto application security standard. The recently released 201...

What you didn’t know about OWASP Top-10 2017? Part 1/3

I hope everybody have already read the latest OWASP Top-10 list . Let me share some useful insights about it. First of all, OWASP Top-10 is NOT a vulnerability classification system. Rather it is a list of the most critical security risks for web application. What’s the difference? For example, t...

shinsegaemall.ssg.com XSS vulnerability

Open Bug Bounty ID: OBB-549293 Description| Value ---|--- Affected Website:| shinsegaemall.ssg.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

2017 in Snort Signatures.

This post was written by Martin Lee and Vanja Svajcer. 2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact organizations throughout the world. In 2017, Talos researchers discovered many...

livebetterpbm.medtipster.com XSS vulnerability

Open Bug Bounty ID: OBB-548929 Description| Value ---|--- Affected Website:| livebetterpbm.medtipster.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal Vulnerability

Exploit for php platform in category web applications Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal / Local File Inclusion Software Link: http://www.pacsone.net/download.htm Google Dork: inurl:pacs/login.php inurl:pacsone/login.php inurl:pacsone filetype:php home...

Nexpose 6.4.66 - Cross-Site Request Forgery

Nexpose 6.4.66 - Cross-Site Request Forgery Exploit Title: Cross Site Request Forgery at Nexpose Automated Actions Release Date: 2017-12-13 Exploit Author: Shwetabh Vishnoi Link: https://www.linkedin.com/in/shwetabhvishnoi Vendor Homepage: https://www.rapid7.com/ Software Link:...

OTRS 5.0.x / 6.0.x Remote Command Execution

Exploit Title: OTRS Shell Access Date: 21-01-2018 Exploit Author: BA|ln0rn Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921 CVE-2017-16921: "In OTRS...

Photography CMS 1.0 Cross Site Request Forgery

New Admin Username: Password: Confirm Password: Email: $"ekleabi".live'click',function $.ajax type: "POST", url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajaxnewadmin.php", data: username:$".efe username".val, password1:$".efe password1".val, password2:$".efe password2".val, email:$".e...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications 0day.today 2018-03-17...

PrestaShop <= 1.7.2.4 Multiple Vulnerabilities

PrestaShop is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)

New Admin Username: Password: Confirm Password: Email: $"ekleabi".live'click',function $.ajax type: "POST", url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajaxnewadmin.php", data: username:$".efe username".val, password1:$".efe password1".val, password2:$".efe password2".val, email:$".e...

LiveCRM SaaS Cloud 1.0 - SQL Injection

Exploit Title: LiveCRM SaaS Cloud 1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://livecrm.co/ Software Link: https://codecanyon.net/item/livecrm-saas-cloud-cloud-based-open-source-complete-business-management-solution-crm/21219419 Version: 1.0 Category: Webapps Tested on:...

41.185.8.55 XSS vulnerability

Open Bug Bounty ID: OBB-537690 Description| Value ---|--- Affected Website:| 41.185.8.55 Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Master IP CAM 01 Vulnerabilities

Some time ago I analized this ipcam with my friend Dzonerzy: var serialNum="VVVIPCSBC150617Z-06929VjmJH54vkK"; var model="RTIPC"; var hardVersion="5900-gc1004"; var softVersion="V3.3.4.2103-S50-SBC-B20150721E"; var ipcname="WIFICAM"; var startdate="2017-8-5 0:0:2"; var runtimes="0 day, 0:54"; var...

Acadmic Microsoft - (API) Filter Cross Site Vulnerability

Document Title: =============== Acadmic Microsoft - API Filter Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2056 MSRC ID: 0001010174 Release Date: ============= 2018-01-20 Vulnerability Laboratory ID VL-ID:...

Claroline < 1.7.7 - Arbitrary File Inclusion Vulnerability

Exploit for php platform in category web applications Claroline Arbitrary File Inclusion Vendor: Claroline Product: Claroline Version: 0 $uidReset = true; $clarologinSucceeded = tr...

OWASP Top 10 2017 is Released

The Journey to the New and Improved Ten Most Critical Web Application Security Risks It was not too long ago that protecting your web server infrastructure consisted of simply placing the servers in their own zone behind the firewall and just opening a couple of ports. Outside of endpoint...

Magento Commerce - CSRLF Web UI Security Vulnerability

Document Title: =============== Magento Commerce - CSRLF Web UI Security Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1573 Release Date: ============= 2018-01-19 Vulnerability Laboratory ID VL-ID: ==================================== 157...