eBrigade ERP 4.5 - SQL Injection

Exploit Title: eBrigade ERP 4.5 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: https://ebrigade.net/ Software Link: https://netcologne.dl.sourceforge.net/project/ebrigade/ebrigade/eBrigade%204.5/ebrigade4.5.zip Version: 4.5 Category: Webapps Tested on:...

WordPress 4.5.x < 4.5.13 MediaElement.js Flash Fallback XSS

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting vulnerability in the Flash fallback files in MediaElement under wp-includes/js/mediaelement. Note that the scanner has not tested for these issues but has instead relied only on...

WordPress 4.5.x < 4.5.10 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A flaw in $wpdb-prepare can create unsafe queries leading to potential SQL injection flaws with plugins and themes. - Multiple cross-site scripting XSS vulnerabilities...

GHSA-4M9R-5GQP-7J82 High severity vulnerability that affects org.dspace:dspace-xmlui

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI...

Dspace Directory Traversal Vulnerability

Dspace is an open source digital asset management system. The system is primarily used to manage and distribute data consisting of digital files or "bitstreams". A directory traversal vulnerability exists in the XMLUI functionality in Dspace versions prior to 3.6, 4.x versions prior to 4.5, and 5...

Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept -------- Request POST /php/login.php...

Nordex N1494.0-4.5 - SQL Injection

Nordex N1494.0-4.5 - SQL Injection Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept...

Nordex N149/4.0-4.5 - SQL Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Conce...

Nordex N149/4.0-4.5 Scada Web Server SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Scada Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Category: webapps --- Proof Of Concept -------- Request POST /php/login.php HTTP/1.1 Cache-Control...

Nordex N149/4.0-4.5 - SQL Injection

Exploit Title: Nordex N149/4.0-4.5 Wind Turbine Web Server - SQL Injection Date: 21-05-2018 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.nordex-online.com Tested on: Windows Version: N149/4.0-4.5 Wind Turbine Category: webapps --- Proof Of Concept -------- Request POST /php/login.php...

Cross site scripting in the system log

Date : 2018-04-18 CVE ID : CVE-2018-10125 Description With a manipulated request, an attacker can implant a script which is executed when a logged in back end user opens the system log. The attacker does not have to be logged in. Affected versions Contao 3. up to 3.5.33 Contao 4.0 Contao 4.1 Cont...

CVE-2015-7461

CVE-2015-7461 describes an XML external entity (XXE) vulnerability in IBM Connections versions 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 prior to CR4. The issue allows remote authenticated users to trigger a denial of service through crafted XML data, causing memory consumption. The vulnerability’s ...

Mercurial Protocol Server Access Control Error Vulnerability

Mercurial is a software developer Matt Mackall developed a set of cross-platform distributed version control software written in Python. The software supports simultaneous processing of plain text and binary files , etc. Protocol server is one of the protocol server . An access control error...

fit-fuers-studium.de XSS vulnerability

Open Bug Bounty ID: OBB-580673 Description| Value ---|--- Affected Website:| fit-fuers-studium.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Typo3 4.5 Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1000132

Mercurial version 4.5 and earlier contains a Incorrect Access Control CWE-285 vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1...

Update Veeam MP Core Services to Support TLS 1.2 Protocol

Challenge Starting with vSphere 6.5, the TLS protocol version 1.2 is enabled by default. Cause To allow Veeam Virtualization Extensions Service and Veeam VMware Collectors to connect to vCenter Servers that use the TLS 1.2 protocol, you must update Veeam MP core services. Solution NOTE: The...

CVE-2018-7169

An issue was discovered in shadow 4.5. newgidmap in shadow-utils is setuid and allows an unprivileged user to be placed in a user namespace where setgroups2 is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if...

CVE-2018-7169

An issue was discovered in shadow 4.5. newgidmap in shadow-utils is setuid and allows an unprivileged user to be placed in a user namespace where setgroups2 is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if...

Privilege escalation

An issue was discovered in shadow 4.5. newgidmap in shadow-utils is setuid and allows an unprivileged user to be placed in a user namespace where setgroups2 is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if...

CVE-2018-7169

An issue was discovered in shadow 4.5. newgidmap in shadow-utils is setuid and allows an unprivileged user to be placed in a user namespace where setgroups2 is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if...