11648 matches found
SJS Simple Job Script - SQL Injection / Cross-Site Scripting Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Simple Job Script - Multiple Vulnerabilities Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://simplejobscript.com/ Download Link: https://github.com/niteosoft/simplejobscript/archive/master.zip Demo Site:...
PT-2019-11649
Name of the Vulnerable Software and Affected Versions: S-CMS PHP version 1.0 Description: The issue allows for a CSRF attack to add a new admin user via the "4.edu.php/admin/ajax.php?type=admin&action=add&lang=0" API endpoint. Recommendations: For S-CMS PHP version 1.0, as a temporary workaround,...
CVE-2019-10237: Cross-Site Request Forgery (CSRF)
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040...
Command injection
Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management NSM 9.1 9.1.7.75 Update 4 and 9.2 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands...
Design/Logic Flaw
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
PT-2019-19940
Name of the Vulnerable Software and Affected Versions S-CMS PHP version 1.0 Description The issue affects S-CMS PHP, where there is a problem related to XSS in the 4.edu.php file via the S id parameter. Recommendations For S-CMS PHP version 1.0, avoid using the S id parameter in the 4.edu.php fil...
CVE-2019-9925: Improper Neutralization of Input During Web Page Generation
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
Hacking microcontroller firmware through a USB
In this article, I want to demonstrate extracting the firmware from a secure USB device running on the Cortex M0. Who hacks video game consoles? The manufacture of counterfeit and unlicensed products is widespread in the world of video game consoles. It's a multi-billion dollar industry in which...
CVE-2017-7510
It is reported that the RHV 4 REST API exposes data used in cloud-init which can include the root password used when creating a system...
Debian DLA-1715-1 : linux-4.9 security update (Spectre)
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-18249 A race condition was discovered in the disk space allocator of F2FS. A user with access to an F2FS volume could use this to cause a deni...
Debian: Security Advisory (DLA-1715-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Product update: Virtuozzo Infrastructure Platform 2.5 Update 4 (2.5.0-1614)
This update provides stability and usability fixes. Vulnerability id: VSTOR-14144, VSTOR-20526 Blink button in the admin panel was not working in some cases. Vulnerability id: VSTOR-20197 Unable to create network bonds. Vulnerability id: VSTOR-20232 Disk replacement occasionally does not allow to...
SQL VSS writer fails for SQL localdb on Azure AD Connect Sync server.
Challenge Backup or replication jobs with Application Aware Image-Processing enabled may fail on the server hosting Azure AD Connect Sync with an error indicating the SQL writer has failed. After the job has failed, running "Vssadmin list writers" from an administrative command prompt on the Azur...
SonyPlaystation 4 (PS4) < 6.20 - WebKit Code Execution Exploit
Exploit for hardware platform in category local exploits...
CVE-2019-1606 Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1606)
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker coul...
Sony Playstation 4 (PS4) 6.20 - WebKit Code Execution (PoC)
Sony Playstation 4 PS4 6.20 - WebKit Code Execution PoC PS4 6.20 WebKit Code Execution PoC ============== This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as...
Sony Playstation 4 (PS4) < 6.20 - WebKit Code Execution (PoC)
PS4 6.20 WebKit Code Execution PoC ============== This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.j...