CVE-2020-25733: Unrestricted Upload of File with Dangerous Type

webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types...

PT-2020-16175

Name of the Vulnerable Software and Affected Versions webTareas versions prior to 2.2 Description The issue allows the upload of dangerous file types, including .exe and .shtml. Recommendations For versions prior to 2.2, update to version 2.2 or later to resolve the issue...

PT-2020-12457

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN572HG3 Description An issue was discovered where a page, specifically a certain live ?.shtml page with the variable syspasswd, is exposed and contains the current administrator password in cleartext i...

CVE-2020-10972: Missing Authentication for Critical Function

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

PT-2020-13084

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN531A6 Wavlink WN551K1 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 WN572HG3 Wavlink WN578A2 Wavlink WN579G3 Wavlink WN579X3 Jetstream AC3000/ERAC3000...

CVE-2020-12266: Missing Authentication for Critical Function

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

CVE-2019-9623

Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "!--exec cmd=" in a .shtml file to ckuploadhandler.php...

CVE-2019-9623

Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "!--exec cmd=" in a .shtml file to ckuploadhandler.php...

PT-2019-19760

Name of the Vulnerable Software and Affected Versions Feng Office version 3.7.0.5 Description The issue allows remote attackers to execute arbitrary code. This can be achieved by using "!--exec cmd=" in a .shtml file to access the ck upload handler.php API endpoint. Recommendations For Feng Offic...

Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Feng Office 3.7.0.5 - Unauthenticated Remote Command Execution', 'Description' = %q This module exploits arbitrar...

CVE-2018-18924

The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message...

PT-2018-14724

Name of the Vulnerable Software and Affected Versions ProjeQtOr version 7.2.5 Description The issue concerns the image-upload feature, which allows remote attackers to execute arbitrary code. This is achieved by uploading a .shtml file containing "exec cmd" because rejected files remain on the...

CVE-2018-18924: Incomplete Cleanup

The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message...

CVE-2018-9156

An issue was discovered on AXIS P1354 IP camera Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude modul...

The vulnerability of the Oracle Fusion Middleware software platform allows a malicious individual to execute arbitrary commands, disrupt the logic of the script, and obtain the original script code.

The vulnerability of the Oracle Containers platform’s J2EE component in Oracle Fusion Middleware software relates to an error that occurs due to improper handling of the zero byte during the transmission of a request to another static page or JSP script using functions like pageContext.forward or...

[Netsparker v3.0.2.0 Community Edition] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

CVE-2013-3506

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...

Command injection

cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...

Mozilla Firefox 4.0 (xul.dll) DLL Hijacking Exploit

Exploit for windows platform in category local exploits Exploit Title: Mozilla Firefox 4.0 xul.dll using .shtml DLL Hijacking Exploit Author: Caddy-Dz Facebook Page: www.facebook.com/islam.caddy E-mail: email protected Category: Local Exploit Tested on: Windows Xp Sp 2 | Special Greets To :...

httpd: AllowOverride Options=IncludesNoExec allows Options Includes

The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring 1 Options Includes, 2 Options +Includes, or 3 Options +IncludesNOEXEC in a .htaccess file, and then...