Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting

Exploit Title: Fiberhome AN5506-04-F - Stored Cross Site Scripting Date: 04.03.2019 Exploit Author: Tauco Vendor Homepage: http://www.fiberhomegroup.com/en/ Version: RP2669 Tested on: Windows 10 CVE : CVE-2019-9556 Description:...

Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications...

PT-2019-19361

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=attachment&f=imagecut&v=init&imgurl=" endpoint, which is connected to the...

PT-2019-19363

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=message&f=message&v=add" endpoint, specifically with the username variable. Recommendations For WUZHI CM...

PT-2019-19362

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue exists due to a cross-site scripting XSS flaw. This flaw can be exploited via the index.php endpoint, specifically through the m, f, v, x, and y parameters. The vulnerable endpoint is...

PT-2019-19364

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=content&f=postinfo&v=listing&set iframe=" API endpoint, which is connected to the...

Debian DSA-4387-1 : openssh - security update

Harry Sintonen from F-Secure Corporation discovered multiple vulnerabilities in OpenSSH, an implementation of the SSH protocol suite. All the vulnerabilities are in found in the scp client implementing the SCP protocol. - CVE-2018-20685 Due to improper directory name validation, the scp client...

[SECURITY] [DSA 4387-1] openssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4387-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez February 09, 2019 https://www.debian.org/security/faq -...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15442

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue allows SQL injection via the keywords parameter in the "index.php?m=promote&f=index&v=search" endpoint. Recommendations For WUZHI CMS version 4.1.0, avoid using the keywords parameter in the affect...

CVE-2018-20572: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15232

Name of the Vulnerable Software and Affected Versions PHPok version 5.0.055 Description A Stored XSS issue was found, which can be exploited via the title parameter to the "api.php?c=post&f=save" API endpoint, accessible through the "index.php?id=book" URI. Recommendations For PHPok version...

PT-2018-15007

Name of the Vulnerable Software and Affected Versions PHPok version 4.9.015 Description An issue was discovered that allows remote attackers to execute arbitrary code. This is achieved through the "Login Background Program Upgrade Compressed Packet Upgrade" action, where a .php file is placed...

[SECURITY] Fedora 28 Update: kde-connect-1.3.3-1.fc28

KDE Connect adds communication between KDE and your smartphone. Currently, you can pair with your Android devices over Wifi using the KDE Connect 1.0 app from Albert Vaka which you can obtain via Google Play, F-Droid or the project website...

[SECURITY] Fedora 27 Update: kde-connect-1.3.3-1.fc27

KDE Connect adds communication between KDE and your smartphone. Currently, you can pair with your Android devices over Wifi using the KDE Connect 1.0 app from Albert Vaka which you can obtain via Google Play, F-Droid or the project website...

PT-2018-14735

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A stored XSS issue was discovered in the index.php file, specifically via the seventh input field when accessing the core index module, at the endpoint "index.php?m=core&f=index". Recommendations For WUZHI C...

PT-2018-14734

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description An issue was discovered in WUZHI CMS, where there is stored XSS in "index.php?m=core&f=index" via an ontoggle attribute to details/open/ within a second input field. Recommendations For WUZHI CMS version...

CVE-2018-18939: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-10709

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read and write CR register values. This could be leveraged in a number of ways to ultimately run...

CVE-2018-10712

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run co...