Bypassing Login Page in 2 Mins
https://aravind07.medium.com/bypassing-login-page-in-2-mins-5b773d46f4d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi ppl! This is Gnana Aravind with another write-up on the most curious “Login Page Bypass”. Let’s jump into the story…Continue reading on Medium » (https://aravind07.medium.com/bypassing-login-page-in-2-mins-5b773d46f4d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

File Upload to RCE
https://ahmed8magdy.medium.com/file-upload-to-rce-538bb4128062?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi , My name is Ahmed Magdy  :)Continue reading on Medium » (https://ahmed8magdy.medium.com/file-upload-to-rce-538bb4128062?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Snakez666
[link] [comments]

File Upload to RCE

Hi , My name is Ahmed Magdy :)Continue reading on Medium »
Read more...

Exploit Collector
Reprise License Manager 14.2 Buffer Overflow

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Reprise License Manager version 14.2 suffers from an authenticated buffer overflow vulnerability.

MD5 | d1b7870de7c214de0386404223b52728

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44154
# Vulnerability Title: Authenticated Buffer Overflow
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
By using an authenticated account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.

Vulnerability:
When writing to options within RLM, if an input is longer than 1024 chars it will result in a buffer overflow, allowing either a secfault, crashing the program, or potentially resulting in RCE.

Recommendation:
Validate input lengths before copying into a buffer.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 User Enumeration

https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
Reprise License Manager version 14.2 suffers from a user enumeration vulnerability.

MD5 | 193bb8c1503c298f61459df2f124a49e

Download
# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44155
# Vulnerability Title: Unauthenticated User Enumeration
# Severity: Low
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
An issue was discovered in /goform/login_process in RLM 14.2. When an attacker attempts to login, the response if an username is valid includes "Login Failed", but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Vulnerability:
This vulnerability is triggered upon failed authentication, if an attacker supplies an invalid user with an invalid password no error message is given however if an attacker supplies the application with a valid user with an invalid password an error message is displayed informing the user "Login Failed". The difference in response can be abused in order to allow an attacker to enumerate valid users.

Recommendation:
We recommend displaying generic error messages upon failed authentication to mitigate the possibility of an attacker enumerating valid users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ETS5 Password Recovery Tool

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
ETS Password Recovery Tool allows you to recover passwords for an ETS5 project. This is due to a significant design flaw as ETS5 uses a hard-coded password and salt to encrypt the project information.

MD5 | 90915ab46d587526fdc2a5369557661e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Remote Binary Execution

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Reprise License Manager version 14.2 suffers from an authenticated remote binary execution vulnerability.

MD5 | 168a71810d65bf8de3fe62438600faa2

Download
# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################

Introduction:

When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Vulnerability:

A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also possible to provide arguments to the executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and then executed.

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely required.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Grafana Arbitrary File Reading

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Grafana suffers from an unauthorized arbitrary file reading vulnerability. Version 8.3.1 addresses this issue.

MD5 | b07119f68d1f96828ea48a5529ee09b5

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Unauthenticated Password Change

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Reprise License Manager version 14.2 suffers from a missing authentication vulnerability that allows for password changing of any existing user.

MD5 | 6e10e8f8887bc874e1ca493b558c5168

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44152
# Vulnerability Title: Unauthenticated Password Change
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.

Vulnerability:
If an unauthenticated user sends the following HTTP request they can change the password of any user:

POST /goform/change_password_process HTTP/1.1
Host: 127.0.0.1:5054
Content-Length: 53

pw1=passwd&pw2=passwd&user=admin&ok=CHANGE%2BPASSWORD

Recommendation:
Ensure that authentication is required prior to password change requests and that users cannot modify or change passwords of others users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video