The operating system used by Pexip Infinity does not create unique SSH host keys on deployment of new Management and Conferencing Nodes, using fixed host keys instead. Host keys are used to verify the identity of the remote host when connecting to it over SSH. These keys are contained in the publicly available software image.
An attacker with privileged network access may make use of these keys to spoof the identity of a Pexip Infinity installation or conduct man-in-the-middle attacks on administrative SSH sessions. This may permit the attacker access to credentials used to authenticate sessions over SSH and provide shell access to the affected systems.
This issue is resolved in Pexip Infinity version 8.
Information ------------ Advisory by Netsparker Name: XSS Vulnerability in Blubrry PowerPress Affected Software : Blubrry PowerPress Affected Versions: 6.0 and possibly below Vendor Homepage :https://wordpress.org/plugins/powerpress/ Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2015-1385 Netsparker Advisory Reference : NS-15-001
Description ----------- By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user?s session. This means that the malicious hacker can change the logged in user?s password and invalidate the session of the victim while the hacker maintains access. As seen from the XSS example in this article, if a web application is vulnerable to cross-site scripting and the administrator?s session is hijacked, the malicious hacker exploiting the vulnerability will have full admin privileges on that web application.
Netsparker finds and reports security issues and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications regardless of the platform and the technology they are built on. Netsparker's unique detection and exploitation techniques allows it to be dead accurate in reporting hence it's the first and the only False Positive Free web application security scanner. --------------------
Proof of Concept URLs for XSS in Blubrry PowerPress WordPress plugin:
About Netsparker -------------------- Netsparker finds and reports security issues and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications regardless of the platform and the technology they are built on. Netsparker's unique detection and exploitation techniques allows it to be dead accurate in reporting hence it's the first and the only False Positive Free web application security scanner. For more information visit our website on https://www.netsparker.com
##################################### Title:- Reflected XSS vulnarbility in Asus RT-N10 Plus router Author: Kaustubh G. Padwad Product: ASUS Router RT-N10 Plus Firmware: 2.1.1.1.70 Severity: Medium Auth: Requierd
# About Vulnerability: Asus Router RT-N10 Plus with firmware 2.1.1.70 is vulnarable for crosss site scripting attack,this may cause a huge network compemise.
#Technical Details: The value of the flag request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload initial78846%27%3balert(" Hacked_BY_S3curity_B3ast")%2f%2f372137b5d was submitted in the flag parameter. This input was echoed unmodified in the application's response.
2. this will ask for creadintial once creatintial enterd it will be successfull XSS
# Disclosure: 8-jan-2015 Repoerted to ASUS 9-jan-2015 Asus confirm that they reported to concern department 15-jan-2015 Ask for update from asus asus says reported to HQ 28-jan-2015 Ask asus about reporting security foucus No reply from ASUS 29-jan-2015 security focus bugtraq