Security News

Re: Quiz And Survey Master 6.0.4 - Reflected XSS (WordPress Plugin)

Full Disclosure - 9 March, 2019 - 13:03

Posted by Henri Salo on Mar 09

MITRE assigned CVE-2019-9575 for this vulnerability.

CVE-2019-6726: Arbitrary File Deletion in WP fastest Cache <= 0.8.9.0

Full Disclosure - 9 March, 2019 - 13:03

Posted by Sebastian Neef on Mar 09

The wordpress plugin "WP Fastest Cache" [0] suffered from an arbitrary file deletion bug.

# Description

A successful attack allows an unauthenticated attacker to specify a path to a directory from which files and
directories will be deleted recursively. The vulnerable code path extracts the path portion of the referrer header and
then uses string concatenation to build an absolute path. This path is then passed to the...

UFONet v-1.3 - [SLY] SingularitY!

Full Disclosure - 9 March, 2019 - 13:02

Posted by psy on Mar 09

Hi,

I have released a new version for UFONet:

https://ufonet.03c8.net/

"UFONet - is a toolkit designed to launch DDoS and DoS attacks."

---------

See these links for more info:

- CWE-601:Open Redirect [1]
- OWASP:URL Redirector Abuse [2]
- Botnet requests schema [3]

---------

Main options are:

* DDoS (botnet) + DoS
* Auto-update
* Clean code
* Documentation with examples
* Web/GUI Interface
* Proxy to connect...

Sparkasse - Multiple Persistent Cross Site Scripting Web Vulnerabilities

Full Disclosure - 7 March, 2019 - 06:00

Posted by Vulnerability Lab on Mar 07

Document Title:
===============
Sparkasse - Multiple Persistent Cross Site Scripting Web Vulnerabilities

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2173

Release Date:
=============
2019-03-07

Vulnerability Laboratory ID (VL-ID):
====================================
2173

Common Vulnerability Scoring System:
====================================
4.6

Vulnerability Class:
====================...

[SECURITY] [DSA 4402-1] mumble security update

Bug Traq - 6 March, 2019 - 08:25

Posted by Moritz Muehlenhoff on Mar 06

-------------------------------------------------------------------------
Debian Security Advisory DSA-4402-1 security () debian org
https://www.debian.org/security/ Moritz Muehlenhoff
March 05, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : mumble
CVE ID : CVE-2018-20743

It was discovered...

Sagemcom router insufficient default PSK entropy

Full Disclosure - 5 March, 2019 - 13:10

Posted by Ryan Delaney on Mar 05

<!--
# Exploit Title: Sagemcom router insufficient default PSK entropy
# Date: 4-3-2019
# Exploit Author: Ryan Delaney
# Author Contact: ryan.delaney () owasp org
# Author LinkedIn: https://www.linkedin.com/in/infosecrd/
# Vendor Homepage: https://www.sagemcom.com/
# Software Link: N/A
# Version: 0.4.39
# Tested on: 0.4.39
# CVE: CVE-2019-9555

1. Description

Sagemcom F@st 5260 routers on firmware version 0.4.39 (and possibly
others), in WPA...

Open Redirection vulnerability in Babel (CMSMS Module)

Full Disclosure - 5 March, 2019 - 13:09

Posted by Jan Kopriva on Mar 05

Affected Software: Babel: Multilingual Site module for CMS Made Simple
Affected Version: 0.4.1 and earlier
Patched Version: None - project is no longer under development
CVE Identifier: TBD
Vulnerability type: CWE-601: URL Redirection to Untrusted Site ('Open
Redirect')
Severity Rating: CVSS v3 Base Score: 6.1
(AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Security Researcher: Jan Kopriva @ Alef Nula

Summary:
The Babel multi-language module...