Posted by Patel, Nirav on Aug 01

Severity: High

Description:

An identified security flaw is present in EmpowerID versions V7.205.0.0 and prior versions, causing the system to
mistakenly send Multi-Factor Authentication (MFA) codes to unintended email addresses. To exploit this vulnerability,
an attacker would need to have access to valid and breached login details, including a username and password.

This vulnerability’s root cause lies in insufficient verification of…

Read More

Posted by Andrey Stoykov on Aug 01

Just putting this for the new starters.

It is in two languages, Bulgarian and English.

https://drive.google.com/file/d/1mzYeratoSV82Oxaj_dYvu4fg7vSBuhE1/view
https://drive.google.com/file/d/1b8obLloMnmQGI1gqAablzuTyKOFBRZjb/view

Has basic configuration for Burpsuite Proxy, including basic exploitation
of XSS, SQLi, CSRF and Open redirect.

Has brief theory explanation prior to showing how to exploit each flaw.

Kind Regards,
Andrey Stoykov

Read More

Posted by Andrey Stoykov on Aug 01

# Exploit Title:
# Date: 07/2023
# Exploit Author: Andrey Stoykov
# Version: 3.2
# Tested on: Windows Server 2022
# Blog: http://msecureltd.blogspot.com

XSS #1:

File: roles.edit.post.php

Line #57:

[…]
<div class=”field-wrap <?php echo $Form->error(‘roleTitle’, false);?>”>
<?php echo $Form->label(‘roleTitle’, ‘Title’); ?>
<div class=”form-entry”>…

Read More

Posted by info () vulnerability-lab com on Aug 01

Document Title:
===============
ETSI WEBstore 2023 – Persistent Cross Site Scripting Web Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2327

Release Date:
=============
2023-07-26

Vulnerability Laboratory ID (VL-ID):
====================================
2327

Common Vulnerability Scoring System:
====================================
4.6

Vulnerability Class:
====================…

Read More

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

Read More

FEDORA-2023-95d73a5f50

Packages in this update:

chromium-115.0.5790.110-1.fc38

Update description:

update to 115.0.5790.110. Fixes the following security issue:

CVE-2022-4908 CVE-2022-4909 CVE-2022-4910 CVE-2022-4908 CVE-2022-4909 CVE-2022-4910 CVE-2022-4906 CVE-2022-4907
CVE-2022-4906 CVE-2022-4907 CVE-2023-2311 CVE-2023-2313 CVE-2023-2311 CVE-2023-2313 CVE-2023-2929 CVE-2023-2929
CVE-2023-2314 CVE-2023-2314 CVE-2023-3598 CVE-2023-3598

Read More