Varient 1.6.1 - SQL Injection

Varient 1.6.1 - SQL Injection =========================================================================================== Exploit Title: Varient 1.6.1 SQL Inj. Dork: N/A Date: 29-06-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://varient.codingest.com/ Software Link:...

Design/Logic Flaw

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC,...

WordPress WP Open Graph plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Open Graph plugin is one of the plugins used to add Facebook metadata to web pages. A cross-site request forgery vulnerability exist...

CVE-2019-11808

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs...

zzzphp CMS 1.6.1 - Cross-Site Request Forgery

Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on:...

zzzcms zzzphp dynamic code execution vulnerability

zzzcms zzzphp is a content management system CMS. A security vulnerability exists in version V1.6.1 of zzzcms zzzphp, which stems from a lax filtering of search template parsing on the search page. An attacker can exploit this vulnerability to execute PHP code...

ZZZCMS zzzphp Cross-Site Request Forgery Vulnerability

ZZZCMS zzzphp is a content management system CMS. A cross-site request forgery vulnerability exists in ZZZCMS zzzphp version V1.6.1. A remote attacker can exploit this vulnerability to inject PHP code with the help of the 'file' and 'filetext' parameters...

AirMore 1.6.1 - Denial of Service Exploit

!/usr/bin/python coding: utf-8 Author: Marcelo Vázquez aka s4vitar AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Exploit Title: AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Date: 2019-02-14 Exploit Author: Marcelo Vázquez aka s4vitar Vendor Homepage: https://airmore.com...

AirMore 1.6.1 - Denial of Service (PoC)

!/usr/bin/python coding: utf-8 Author: Marcelo Vázquez aka s4vitar AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Exploit Title: AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Date: 2019-02-14 Exploit Author: Marcelo Vázquez aka s4vitar Vendor Homepage: https://airmore.com...

AirMore 1.6.1 Denial Of Service

!/usr/bin/python coding: utf-8 Author: Marcelo VA!zquez aka s4vitar AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Exploit Title: AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Date: 2019-02-14 Exploit Author: Marcelo VA!zquez aka s4vitar Vendor Homepage:...

AirMore 1.6.1 - Denial of Service (PoC)

AirMore 1.6.1 - Denial of Service PoC !/usr/bin/python coding: utf-8 Author: Marcelo Vázquez aka s4vitar AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Exploit Title: AirMore 1.6.1 Remote Denial of Service DoS & System Freeze Date: 2019-02-14 Exploit Author: Marcelo Vázquez aka s4vita...

Grocery crud 1.6.1 - 'search_field' SQL Injection

Exploit Title: Grocery crud 1.6.1 - 'searchfield' SQL Injection Google Dork: n/a Date: 2018-11-05 Exploit Author: Loading Kura Kura Vendor Homepage: https://www.grocerycrud.com/ Software Link: https://www.grocerycrud.com/downloads Version: 1.6.1 Tested on: Win10/Kali Linux CVE : 1. Proof of Conce...

Nginx < 1.6.1 SMTP STARTTLS Command Injection

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function...

Vanilla: Persistent XSS via Signatures

Description ----------- The current version of the signature plugin 1.6.1 is vulnerable to persistent XSS as the Format parameter is echoed without encoding. POC --- Prerequisite: Enable the Signatures plugin To place the payload, the following request can be used it's simply the request that is...

Debian: Security Advisory (DLA-1517-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CloudBees Jenkins Tinfoil Security Plugin Information Disclosure Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Tinfoil Security Plugin is used in o...

Nextcloud Calendar Cross-Site Scripting Vulnerability

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Calendar is one of the calendar applications. A cross-site scripting vulnerability exists in Nextcloud Calendar versions prior to 1.5.8 and prior t...

PT-2018-16182 · Nextcloud · Nextcloud Calendar

Name of the Vulnerable Software and Affected Versions: Nextcloud Calendar versions prior to 1.5.8 Nextcloud Calendar versions prior to 1.6.1 Description: A stored XSS issue exists due to missing sanitization of search results for an autocomplete field, requiring user-interaction. This issue is...

Restafary Path Traversal Vulnerability

Restafary is a program for GRUD file manipulation. A path traversal vulnerability exists in Restafary versions prior to 1.6.1, which stems from the fact that restafary can be run at a path other than the specified root path. No details of the vulnerability are provided at this time...

UBUNTU-CVE-2015-5377

DISPUTED Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability...