Jump to content

Search the Community

Showing results for tags 'task'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges
    • Bug Bounty
    • Programare
    • Reverse engineering & exploit development
    • Mobile phones
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Fake News Romania
    • Sugestii
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Categories

There are no results to display.

There are no results to display.

Blogs

There are no results to display.

There are no results to display.


Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Website URL


Yahoo


Jabber


Skype


Location


Interests


Biography


Location


Interests


Occupation

Found 2 results

  1. # Exploit Title: OpenKM Platform Remote Reflected Cross Site Scripting # Google Dork: N/A # Date: 18-11-2014 # Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh) # Vendor Homepage: http://www.openkm.com/en <http://s.bl-1.com/h/mQ2bNXq?url=http://www.openkm.com/en>/ # Software Link: http://www.openkm.com/en/download-english.html <http://s.bl-1.com/h/mQ2bTws?url=http://www.openkm.com/en/download-english.html> # Version: All versions < 6.4.19 (built 23338) # Tested on: All OS # CVE : 2014-9017 -About OpenKM OpenKM is a Free/Libre document management system that provides a web interface for managing arbitrary files. OpenKM includes a content repository, Lucene indexing, and jBPM workflow. The OpenKM system was developed using Java technology. In 2005 two developers involved in open source technologies and expertise with some commercial document management solutions (Sharepoint, Documentum, Hummingbird, among others) like Excalibur search engine or Kofax OCR engine decided to start an open source project based on high level technologies to build a document management system that they decided to call OpenKM. "-Wikipedia" -Reference: http://en.wikipedia.org/wiki/OpenKM <http://s.bl-1.com/h/mQ2bYKv?url=http://en.wikipedia.org/wiki/OpenKM> -Vulnerability: Remote Reflected/Stored Cross Site Scripting with no remote interaction -Severity: Very Critical -Vulnerable Parameter(s)/Input(s): Tasks -Info: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 <http://s.bl-1.com/h/mQ2cfkx?url=https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29> -Impact: Remote Admin or Users Full Account Takeover with no interaction. -Attack Scenario: 1. User#1 "Attacker" : Creates a task with a vulnerable name and assign it to another User/Admin "Targeted Victim". 2. User#2 "Victim" : Got Exploited with the vulnerable Task made by the Attacker "User#1" since the Task notification will automatically appears to the assigned user side "Victim" also the notification popup displays the vulnerable task name and the victim will be exploited with no interactions. -PS: This is the most critical attack you will see on OpenKM platform because it will work remotely against users even with the same scenario described in the report you can steal/execute a JS in the Administrator's session. -PoC Video: http://youtu.be/3jBQFAAq23k Thanks -- *Best Regards**,**,* *Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist & Bug Bounty Hunter. LinkedIn <http://s.bl-1.com/h/mQ2ck6z?url=https://www.linkedin.com/in/symbiansymoh>Curriculum Vitae <http://s.bl-1.com/h/mQ2coW1?url=http://goo.gl/cNrVpL> <http://s.bl-1.com/h/mQ2ctv3?url=https://www.linkedin.com/in/symbiansymoh> Facebook <http://s.bl-1.com/h/mQ2cyJ5?url=https://fb.com/symbiansymoh>Twitter <http://s.bl-1.com/h/mQ2c3j7?url=https://twitter.com/symbiansymoh> Source
  2. Process Detailer Version : 1.0 Features : - Show processes list - Display process name - Display process ID (PID) - Display process username - Display process path - Display process memory usage - Display total percentage of used memory - Get process details - End process by name - End process by PID - Run on startup - Tray icon Screenshot Download : CrownSoft - Process Detailer 1.0 by me
×
×
  • Create New...