824 matches found
Linux Kernel 4.4 rtnetlink Stack Memory Disclosure
/ Briefs - CVE-2016-4486 has discovered and reported by Kangjie Lu. - This is local exploit against the CVE-2016-4486. Tested version - Distro : Ubuntu 16.04 - Kernel version : 4.4.0-21-generic - Arch : x8664 Prerequisites - None Goal - Leak kernel stack base address of current process by...
CVE-2018-17948
The vulnerability CVE-2018-17948 is described as an open redirect in the Access Manager Identity Provider prior to 4.4 SP3. The primary documented impact areas are limited to the redirect mechanism; CVSS metrics indicate a MEDIUM severity (CVSS v3.0: 6.1) with NETWORK access, no privileges requir...
Design/Logic Flaw
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3...
CVE-2018-12480
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3...
CVE-2018-19131
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTPS error page generation for certificate errors...
WordPress 4.4.x < 4.4.16 Arbitrary File Deletion
According to its self-reported version number, the detected WordPress application is affected by issue that could allow a user who is able to edit uploaded media to attempt to delete files outside the uploads directory. Note that the scanner has not tested for these issues but has instead relied...
CVE-2018-15898
The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might allow man-in-the-middle attackers to obtain interaction data...
Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation Exploit
This Metasploit module attempts to gain root privileges on Linux systems by abusing UDP Fragmentation Offload UFO. This exploit targets only systems using Ubuntu Trusty / Xenial kernels 4.4.0-21 'Linux Kernel UDP Fragmentation Offset UFO Privilege Escalation', 'Description' = %q This module...
CVE-2017-2590
CVE-2017-2590 is an IPA/Dogtag-CA vulnerability where an authenticated, unauthorized user could exploit insufficient permission checks to run ca-del, ca-disable, or ca-enable, potentially deleting, disabling, or enabling CAs and causing denial-of-service in certificate issuance, OCSP signing, and...
CVE-2018-2962
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite subcomponent: Web Access. Supported versions that are affected are 8.4, 15.x, 16.x and 17.x. Difficult to exploit vulnerability allows low privileged attacker with...
Ftp Server 1.32 - Credential Disclosure Vulnerability
Exploit for Android platform in category local exploits Exploit Title: Ftp Server 1.32 - Credential Disclosure Software Link: https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver Version: 1.32 Android App Vendor: The Olive Tree Exploit Author: ManhNho CVE: N/A Category: Mobile...
FTP Server 1.32 Credential Disclosure
Exploit Title: Ftp Server 1.32 - Credential Disclosure Date: 2018-05-29 Software Link: https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver Version: 1.32 Android App Vendor: The Olive Tree Exploit Author: ManhNho CVE: N/A Category: Mobile Apps Tested on: Android 4.4 Descriptio...
Werewolf Online 0.8.8 - Information Disclosure
Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link: https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details Exploit Author: ManhNho Version...
Design/Logic Flaw
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach...
Cross site request forgery (csrf)
A CSRF exposure exists in NetIQ Access Manager NAM 4.4 Identity Server component...
CVE-2018-7677
The CVE-2018-7677 entry applies to NetIQ Access Manager (NAM) 4.4 Identity Server component. The vulnerability arises because HTTP requests are not properly validated, creating a cross-site request forgery (CSRF) exposure. This allows an attacker to perform unauthorized operations against the aff...
CVE-2016-9575
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary...
CVE-2016-9575
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary...
CVE-2017-18092
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...