CVE-2020-15391

DevSpace 4.13.0 contains a vulnerability where the UI allows actions on pods via WebSocket without authentication, enabling remote code execution. The issue is tied to lack of authentication for WebSocket communications, leading to possible control of victim-side pods over the network. Acknowledg...

Cross site scripting

An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage...

CVE-2020-15892

The CVE-2020-15892 issue affects D-Link DAP-1520 firmware (pre-1.10b04Beta02) in apply.cgi. The login flow forwards POST values to an ssi binary, and client-side validation limits the password to 15 chars, which can be bypassed. An attacker intercepting a login POST and modifying the vulnerable p...

CVE-2020-15895

D-Link DIR-816L devices (2.x) before 1.10b04Beta02 contain an XSS in webinc/js/info.php where the RESULT parameter is printed without output filtration. An attacker can inject arbitrary script in a victim’s browser, potentially enabling cookie-based credential theft and other browser-based attack...

CVE-2020-6535

CVE-2020-6535 affects Google Chrome/WebUI where insufficient data validation in the WebUI allowed a renderer-compromised attacker to inject scripts/HTML into a privileged page via a crafted HTML page. The vulnerability targets Chrome versions prior to 84.0.4147.89. Public sources in connected doc...

fws.com.hk Cross Site Scripting vulnerability OBB-1234873

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

bozdoganhukuk.com Cross Site Scripting vulnerability OBB-1234637

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

OPENSUSE-SU-2020:1021-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo1174189: Critical CVE-2020-6510: Heap buffer overflow in background fetch. High CVE-2020-6511: Side-channel information leakage in content security policy. High CVE-2020-6512: Type Confusion in V8. High CVE-2020-6513...

thaiskyadventures.com Improper Access Control vulnerability OBB-1232726

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

in.coimgroup.com Cross Site Scripting vulnerability OBB-1230560

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

untappd.com Cross Site Scripting vulnerability OBB-1228267

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

cebupacificaircorporate.com Cross Site Scripting vulnerability OBB-1228075

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2019-4748

CVE-2019-4748 affects IBM Jazz Team Server based Applications. The vulnerability is a cross-site scripting issue in the Web UI that could allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin lists multi...

webkatalog-linkkatalog.de Cross Site Scripting vulnerability OBB-1227263

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Exploit for Improper Resource Shutdown or Release in Microsoft

Web-Security-Note Record some common Web security sites 由于平常读过的文章以及遇到的比较好的开源项目都被渐渐遗忘了，所以利用这个项目来记录一下，以便查阅。 目录： - CTF - Online-Tools - 漏洞环境 - 信息搜集 - 工具 - 面经 - BypassWAF - WEB安全 - 漏洞挖掘 - 渗透测试 - 内网渗透 - 扫描器开发 - 开发 - 运维 CTF + CTF Time + Pwnhub + CTF论剑场 + 南京邮电大学CTF平台 + Whale CTF + JarvisOJ + Hackme CTF ...

Nextcloud: PIN for passwordless WebAuthn is asked for but not verified

Nextcloud introduced WebAuthn passwordless authentication with version 19. As far as we understand, you assume that your implementation provide two-factor authentication: "The server asking for authentication can request verification of multiple factors, so that a configured key requires the user...

CVE-2020-1456

CVE-2020-1456 is a SharePoint Server cross-site scripting (XSS) vulnerability. The initial doc describes exploitation via an improperly sanitized crafted web request, enabling script execution in the user’s context (XSS). Connected documents (CNVD entries) corroborate a SharePoint Server XSS weak...

The Interaction Between Identity Cloud and Akamai Edge Services

Akamai Identity Cloud is a purpose-built customer identity and access management CIAM platform specifically architected to meet the needs of application owners and API providers' consumer identity needs. As a cloud-based SaaS offering, all interactions with Identity Cloud occur over the public...

Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 - Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Trend Micro Web Security Virtual Appliance Remote Code Execution', 'Description' = %q This module exploits multiple vulnerabilities together in...

Trend Micro Web Security Virtual Appliance 6.5 SP2 Patch 4 Build 1901 Remote Code Execution Exploit

Exploit for multiple platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Trend Micro Web Security Virtual Appliance Remote Code Execution', 'Description' = %q...