2295 matches found
CVE-2016-10322
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...
CVE-2016-10322: Improper Neutralization of Special Elements used in a Command
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...
PT-2017-7860
Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2958 Description The issue allows remote authenticated guest users to execute arbitrary commands. This can be achieved by using shell metacharacters in the X-Forwarded-For HTTP header to the...
Serv-U FTP/MFT Server Unauthenticated Privilege Escalation
Details source: https://www.trustwave.com/Resources/SpiderLabs-Blog/Exploiting-Privilege-Escalation-in-Serv-U-by-SolarWinds/?page=1&year=0&month=0 I was recently working on an external network penetration test where I identified a new vulnerability in a file sharing web application called Serv-U ...
Rockstar Games: Bypass CAPTCHA protection
In this report, the researcher found that it was possible to bypass our CAPTCHA check by injecting a random value into the X-Forwarded-For header in the sign in POST request. At the time the researcher submitted this report, we only enforced CAPTCHA checks on sign-in requests that had failed...
Exploit for Improper Input Validation in Joomla Joomla\!
CVE-2015-8562 - Reverse shell python Exploit: Joomla 1.5 - 3...
Osticket 1.9.14 - X-Forwarded-For Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket i...
Osticket 1.9.14 Cross Site Scripting
Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...
osTicket 1.9.14 - X-Forwarded-For Cross-Site Scripting
osTicket 1.9.14 - X-Forwarded-For Cross-Site Scripting Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket ...
osTicket 1.9.14 - 'X-Forwarded-For' Cross-Site Scripting
Exploit Title: Osticket 1.9.14 and below X-Forwarded-For Stored XSS. Date: 24-11-2016 Exploit Author: Joaquin Ramirez Martinez i0-SEC Software Link: http://osticket.com/ Vendor: Osticket """ ============== DESCRIPTION ============== osTicket is a widely-used open source support ticket system. It...
Boozt Fashion AB: Email link poisoning / Host header attack
Description ------------- It is possible to poison the link of the password reset email. This is generally done by altering the Host header, but in this case, the WAF is successfully blocking it. The trick here is to add an X-Forwarded-Host header in the request so the server is using this value...
X-Forwarded-For Header Insert
Use Case X-Forwarded-For header can be used to pass the Client IP information to the backend server. When HTTP request contains X-Forwarded-For header, the values will be replaced with single client IP address. If there is no X-Forwarded-For header, it will be added and assigned with the client I...
Parse HTTP X-Forwarded Header Attack Redirect
Document Title: =============== Parse HTTP X-Forwarded Header Attack Redirect References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1944 PoC Video: https://www.youtube.com/watch?v=gpYe-hun8Xk Vulnerability Magazine:...
Parse HTTP X-Forwarded Header Attack Redirect
Document Title: =============== Parse HTTP X-Forwarded Header Attack Redirect References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1944 PoC Video: https://www.youtube.com/watch?v=gpYe-hun8Xk Vulnerability Magazine:...
WordPress Activity Log 2.3.1 Persistent Cross Site Scripting
Persistent Cross-Site Scripting in WordPress Activity Log plugin Han Sahin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker can inject malicious JavaScript code into the application, which will...
Radancy: Application error message
Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...
WordPress Huge-IT Image Gallery 1.8.9 Plugin - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: WordPress plugin Image Gallery Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/gallery-images/" Date: 12-05-2016 Software Link: https://fr.wordpress.org/plugins/gallery-images/ Version: 1.8.9 and...
How to forward client IP to back-end server using "x-forwarded-for" header on Citrix ADC
To forwardClient IP to Back-End Server Using "x-forwarded-for" Header...
CVE-2016-3968: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject arbitrary web scrip...
New Relic: Host Header Injection / Cache Poisoning
The application reflects HTTP Header value back in it's response and it may be possible to poison the server cache. The X-Forwarded-Host is directly reflected as a hyperlink. HTTP Request GET / HTTP/1.1 Host: newrelic.com X-Forwarded-Host: pavanw3b.com ... .... HTTP Response HTTP/1.1 200 OK...