PikPikcU pikpikcu

CVE-2020-0601 AKA ChainOfFools OR CurveBall

General

Microsoft disclosed a vulnerability in their monthly Patch Tuesday referenced under CVE-2020-0601.
The vulnerability was discovered by the U.S. National Security Agency, anounced today (2020-01-14) in their press conference, followed by a blog post and an official security advisory.
The flaw is located in the "CRYPT32.DLL" file under the C:\Windows\System32\ directory.

Vulnerability explanation

NSA description:
NSA has discovered a critical vulnerability (CVE-2020-0601) affecting Microsoft Windows® cryptographic functionality.

FusionPBX file app/fax/fax_log_view.php "fax_uuid" parameter XSS (CVE-2019-19384)

Cross-site scripting (XSS) vulnerability in file app/fax/fax_log_view.php in FusionPBX 4.5.10 allows remote attackers to inject arbitrary web script or HTML via the "fax_uuid" parameter.

proof of concept:
https://domain/app/fax/fax_log_view.php?fax_uuid=123%27%22%3E%3Csvg/onload=alert(document.domain)%3E%3Ca

Fixed:

Program Name: 0x Project
Policy URL: https://blog.0xproject.com/announcing-the-0x-protocol-bug-bounty-b0559d2738c
Submission URL: [email protected]

Program Name: 1Password Game

Microsoft

CVE-2025-53803

AMD

MediaTek

CVE-2018-9111

[Suggested description] Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.

[Vulnerability Type]

	#!/usr/bin/env python3
	"""
	InSCRAPEsula v0.1
	Inspired by and sections borrowed from https://github.com/ziplokk1/incapsula-cracker-py3"
	"""
	import logging
	import re
	from ast import literal_eval
	from base64 import b64encode, b64decode
	from random import random

	/.s3cfg
	/phpunit.xml
	/nginx.conf
	/.vimrc
	/LICENSE.md
	/yarn.lock
	/Gulpfile
	/Gulpfile.js
	/composer.json
	/.npmignore

	/*

	================================ Compile as a .Net DLL ==============================
	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs

	*/

	using System.Windows.Forms;

	namespace TestNamespace

	#!/bin/bash

	#
	# Execute as wget -O - https://gist.github.com/LuD1161/66f30da6d8b6c1c05b9f6708525ea885/raw \| bash
	# # Thanks JeffreyShran for the gist url thing
	#
	#
	# It's debian based, so for centos and likewise you have to change apt to yum and similarly
	#
	InstallationStartTime=$(date +%s)

	if [[ "$(dig @1.1.1.1 A,CNAME {test321123,testingforwildcard,plsdontgimmearesult}.$domain +short \| wc -l)" -gt "1" ]]; then
	echo "[!] Possible wildcard detected."
	fi