Information disclosure in SSB-DB

Impact What kind of vulnerability is it? Who is impacted? Servers running SSB-DB 20.0.0 which is packaged with SSB-Server 16.0.0 must upgrade immediately. There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild. The get method is supposed to onl...

CVE-2020-4045: Exposure of Sensitive Information to an Unauthorized Actor

SSB-DB version 20.0.0 has an information disclosure vulnerability. The get method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which ...

Security Bulletin: User Credentials submitted using GET method

Summary IBM Worklight/MobileFoundation has addressed the following vulnerability. User Credentials submitted using GET method Vulnerability Details CVEID: CVE-2020-4226 DESCRIPTION: IBM WorkLight stores highly sensitive information in URL parameters. This may lead to information disclosure if...

CVE-2020-13129

Stashcat app (versions up to 3.9.1 on macOS/Windows/Android/iOS) is affected by a information-disclosure flaw where a GET request includes client_key and device_id in the query string, allowing an observer with access to web server logs to read sensitive data. CVSSv3.1 base score 7.2 ( HIGH ) wit...

Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)

Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...

IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting

Title: IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting Date: 2020-01-27 Author: Lutfu Mert Ceylan Vendor Homepage: www.icewarp.com Tested on: Windows 10 Versions: 11.4.4.1 and before Vulnerable Parameter: "color" Get Method Google Dork: inurl:/webmail/ intext:Powered by IceWarp Server...

Rockwellautomation 1763-l16awa Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00...

V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download

V-SOL GPON/EPON OLT Platform v2.03 Unauthenticated Configuration Download Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Affected version: V2.03.62RIPv6 V2.03.54R V2.03.52R V2.03.49 V2.03.47 V2.03.40 V2.03.26 V2.03.24 V1.8.6 V1.4 Summary: GPO...

Cross-Site Request Forgery (CSRF)

bagisto/bagisto is vulnerable to cross-site request forgery CSRF. The vulnerability exists as sensitive admin endpoints were allowed to use the GET method instead of POST...

PT-2019-19917

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1 Description The issue allows an attacker to bypass password validation and access the management page by using the GET method to request the /admin page. Recommendations For eClass platform version...

Karenderia Multiple Restaurant System 5.3 - Local File Inclusion

Karenderia Multiple Restaurant System 5.3 - Local File Inclusion =========================================================================================== Exploit Title: Karenderia CMS 5.1 - LFI Vuln. Dork: N/A Date: 04-07-2019 Exploit Author: Mehmet EMIROGLU Software Link:...

PHPwind v9.1.0 - Multiple Cross Site Scripting Vulnerabilities

Document Title: =============== PHPwind v9.1.0 - Multiple Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2184 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13472 CVE-ID: ======= CVE-2019-13472 Release Dat...

PasteShr 1.6 - Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: PasteShr - SQL İnj. Dork: N/A Date: 14-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...

Rockwell Automation/Allen-Bradley MicroLogix Controllers <= 16.00 Information Exposure

Binary data 720124.prm...

Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal RESTful Web Services unserialize RCE', 'Description' = %q This module exploits a PHP unserialize vulnerability in Drupal RESTful Web...

MiniShare 1.4.1 HEAD / POST Buffer Overflow

Hi!!! playing in 2006.... I have adapted the exploit to python Not only the GET method is vulnerable to BOF CVE-2004-2271. HEAD and POST methods are also vulnerable. The difference is minimal, both are exploited in the same way. Only 1 byte difference: GET = 3, HEAD and POST = 4 length...

WUZHICMS 2.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in t...

WUZHICMS 2.0 Cross Site Scripting

Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-10-01 Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in the WUZHICMS 2.0 web-application. The...

WUZHICMS 2.0 - Cross-Site Scripting

WUZHICMS 2.0 - Cross-Site Scripting Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-10-01 Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in th...

WUZHICMS 2.0 - Cross-Site Scripting

Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-10-01 Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in the WUZHICMS 2.0 web-application. The...