[Cleartext Transmission of Sensitive Information] CVE-2022-30115: HSTS bypass via trailing dot

Advisory: https://curl.se/docs/CVE-2022-30115.html

Original Report: https://hackerone.com/reports/1557449

## Impact

HSTS bypass


[Remote File Inclusion] [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick

**Summary:**
HackerOne's image upload is using ImageMagick to convert/resize images and is likely updated. Thus, it's vulnerable to CVE-2022-44268.

**Description:**

### Steps To Reproduce
1. Navigate to your profile
2. Edit and upload the attached image (`im-lfi.png`) as your profile picture
3. Save changes and download the resized picture
4. Issue the following command to view the downloaded image's profile data;


[Uncontrolled Resource Consumption] CVE-2022-27781: CERTINFO never-ending busy-loop

## Summary:
Curl is prone to a DoS attack in case the NSS TLS library is used and the CERTINFO option is enabled. Using maliciously crafted certificates on a server, an attacker can make curl run into an endless loop when connecting to the server. The bug is located in the following code segment (https://github.com/curl/curl/blob/master/lib/vtls/nss.c#L1014):

```
/* Count certificates in chain. */
int i = 1;
no


[Uncontrolled Resource Consumption] CVE-2023-28755: ReDoS vulnerability in URI

Original report on the Ruby program: https://hackerone.com/reports/1444501
Advisort: https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
NIST entry: https://nvd.nist.gov/vuln/detail/CVE-2023-28755
CVSS:  7.5 high `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` as listed by NIST but frankly I disagree with the `UI:N` part, I won't mind the extra 2k if you go with NIST but it didn't feel right not


[Type Confusion] Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.

## Summary:
Octal Type Handling of Errors in IPv4 Mapped IPv6 Addresses in curl  allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on curl.

[RFC 4291](https://datatracker.ietf.org/doc/html/rfc4291#section-2-5-5) defines ways to embed an IPv4 address into IPv6 addresses. One of


Dirty Pipe - CVE-2022-0847 - Linux Privilege Escalation

Dirty Pipe - CVE-2022-0847 1280×720 301 KB Video Tutorial CVE-2022-0847 - Dirty Pipe - Linux Privilege Escalation GitHub Repo: GitHub - AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits: A collection of exploits and documentation that can be used to exploit the Linux Dirty Pipe vulnerability. About The Vulnerability Dirty Pipe (CVE-2022-0847) is a local privilege escalation vulnerability in the Linux kernel that could potentially allow an unpri


BoardLight writeup by evyatar9

Read my writeup to BoardLIght machine on: github.com Writeups/HackTheBox/BoardLight at master · evyatar9/Writeups This repository contains writeups for various CTFs I've participated in (Including Hack The Box). - evyatar9/Writeups TL;DR User : Discovered the virtual host crm.board.htb running Dolibarr 17.0.0 , which is vulnerable to CVE-2023-30253 . Exploit this CVE to obtain a reverse shell as www-data . Reuse the database password from conf.php for SSH login as


TwoMillion - HackTheBox WriteUp en Español

URL: Yw4rf TwoMillion es una máquina de la plataforma HackTheBox . En esta ocasión nos encontraremos con dos puertos abiertos 22/SSH y 80/HTTP. Obtendremos un codigo de invitación descifrando código encriptado, enumeraremos una API para poder acceder como administrador, inyectaremos una reverse shell, encontraremos una base de datos lo que nos llevara a encontrar usuario y contraseña en un archivo .env y debido a que el Kernel Linux está desactualizado


Mailing writeup by evyatar9

Read my writeup for Mailing machine on: github.com Writeups/HackTheBox/Usage at master · evyatar9/Writeups This repository contains writeups for various CTFs I've participated in (Including Hack The Box). - evyatar9/Writeups TL;DR User : Found an LFI vulnerability in the download.php file. Download the hMailServer.ini file to obtain the password for the Administrator mailbox. Use CVE-2024-21413 to leak the NTLM hash of the user maya . Root : Discovered LibreOffice .


Lighttpd 1.4.56 - 1.4.66 Resource Leak Denial of Service PoC

Severity: medium


ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution

Severity: critical


NLB mKlik Makedonija 3.3.12 SQL Injection

Severity: medium


RoyalTSX 6.0.1 RTSZ File Handling Heap Memory Corruption PoC

Severity: medium


Tinycontrol LAN Controller v3 (LK3) Remote Admin Password Change

Severity: critical


Tinycontrol LAN Controller v3 (LK3) Remote Denial Of Service Exploit

Severity: high


EuroTel ETL3100 Transmitter Unauthenticated Config/Log Download Vulnerability

Severity: critical


EuroTel ETL3100 Transmitter Authorization Bypass (IDOR)

Severity: high


EuroTel ETL3100 Transmitter Default Credentials

Severity: high


Anevia Flamingo XL 3.6.20 Authenticated Root Remote Code Execution

Severity: high


Anevia Flamingo XS 3.6.5 Authenticated Root Remote Code Execution

Severity: high


Anevia Flamingo XL/XS 3.6.x Default/Hard-coded Credentials

Severity: high


Screen SFT DAB 600/C Unauthenticated Information Disclosure (userManager.cgx)

Severity: medium


Screen SFT DAB 600/C Authentication Bypass Reset Board Config Exploit

Severity: medium


Screen SFT DAB 600/C Authentication Bypass Admin Password Change Exploit

Severity: high


Screen SFT DAB 600/C Authentication Bypass Erase Account Exploit

Severity: high


Screen SFT DAB 600/C Authentication Bypass Password Change Exploit

Severity: high


Screen SFT DAB 600/C Authentication Bypass Account Creation Exploit

Severity: high


Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit

Severity: critical


Sielco PolyEco Digital FM Transmitter 2.0.6 Authorization Bypass Factory Reset

Severity: critical


Sielco PolyEco Digital FM Transmitter 2.0.6 Radio Data System POST Manipulation

Severity: high


Sielco PolyEco Digital FM Transmitter 2.0.6 Unauthenticated Information Disclosure

Severity: medium


Sielco PolyEco Digital FM Transmitter 2.0.6 Account Takeover / Lockout / EoP

Severity: critical


Sielco PolyEco Digital FM Transmitter 2.0.6 Default Credentials

Severity: high


Sielco PolyEco Digital FM Transmitter 2.0.6 'polyeco' Session Hijacking

Severity: high


Sielco Radio Link 2.06 'id' Cookie Brute Force Session Hijacking

Severity: high


Sielco Radio Link 2.06 Cross-Site Request Forgery (Add Admin)

Severity: high


Sielco Radio Link 2.06 Improper Access Control Change Admin Password

Severity: high


Sielco Radio Link 2.06 Remote Privilege Escalation

Severity: high


Sielco Analog FM Transmitter 2.12 'id' Cookie Brute Force Session Hijacking

Severity: high


Sielco Analog FM Transmitter 2.12 Cross-Site Request Forgery

Severity: high


Sielco Analog FM Transmitter 2.12 Improper Access Control Change Admin Password

Severity: high


Sielco Analog FM Transmitter 2.12 Remote Privilege Escalation

Severity: high


Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit

Severity: critical


Osprey Pump Controller 1.0.1 Cross-Site Request Forgery

Severity: high


Osprey Pump Controller 1.0.1 Authentication Bypass Credentials Modification

Severity: critical


Osprey Pump Controller 1.0.1 Unauthenticated Reflected XSS

Severity: high


Osprey Pump Controller 1.0.1 (eventFileSelected) Command Injection

Severity: critical


Osprey Pump Controller 1.0.1 (userName) Blind Command Injection

Severity: critical


Osprey Pump Controller 1.0.1 (pseudonym) Semi-blind Command Injection

Severity: critical


Osprey Pump Controller 1.0.1 Administrator Backdoor Access

Severity: critical


Osprey Pump Controller 1.0.1 Unauthenticated File Disclosure

Severity: critical


Osprey Pump Controller 1.0.1 Predictable Session Token / Session Hijack

Severity: medium


SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

Severity: high


Hughes Satellite Router Remote File Inclusion Cross-Frame Scripting

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (restorefactory.cgi) Factory Reset

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (upload.cgi) Unauthenticated Code Execution

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (traceroute.php) Conditional Command Injection

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (username) Command Injection

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (password) Unauthenticated Command Injection

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (services) Authenticated Command Injection

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (PHPTail) Unauthenticated File Disclosure

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (ping.php) Conditional Command Injection

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure

Severity: medium


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (dns.php) Conditional Command Injection

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (Index of /log) Information Disclosure

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (username) Stored Cross-Site Scripting

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Directory Traversal File Write Exploit

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (sound4server) Hardcoded Credentials

Severity: high


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (ping/traceroute) ICMP Flood Attack

Severity: medium


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (username) Authentication Bypass

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (password) Authentication Bypass

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration

Severity: medium


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authorization Bypass (IDOR)

Severity: critical


SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Cross-Site Request Forgery

Severity: medium


SOUND4 Server Service 4.1.102 Local Privilege Escalation

Severity: low


Spitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection

Severity: high


MiniDVBLinux 5.4 Remote Root Command Execution Vulnerability

Severity: critical


SoX 14.4.2 (wav.c) Division By Zero

Severity: low


ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSS

Severity: high


Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) Remote Root Exploit

Severity: high


Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal

Severity: high


JM-DATA ONU JF511-TV Multiple Remote Vulnerabilities

Severity: high


Tenda HG6 v3.3.0 Remote Command Injection Vulnerability

Severity: high


USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor

Severity: critical


Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure

Severity: medium


Delta Controls enteliTOUCH 3.40.3935 Cross-Site Scripting (XSS)

Severity: medium


Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)

Severity: medium


Verizon 4G LTE Network Extender Weak Credentials Algorithm

Severity: medium


ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

Severity: medium


ICT Protege GX/WX 2.08 Authenticated Stored XSS Vulnerability

Severity: medium


ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD

Severity: high


H3C SSL VPN Username Enumeration

Severity: low


Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption (Denial of Service)

Severity: low


Panasonic Sanyo CCTV Network Camera 2.03 CSRF Disable Auth / Change Password

Severity: medium


Ricon Industrial Cellular Router S9922XL Remote Command Execution

Severity: high


FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Arbitrary File Disclosure

Severity: high


FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Remote Root Exploit

Severity: critical