CVE-2019-0026 Juniper ATP: Persistent Cross-Site Scripting vulnerability in Zone configuration

A persistent cross-site scripting XSS vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Sql injection

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

CVE-2019-6295

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

CVE-2019-6296

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

Sql injection

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

CVE-2019-6295

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

CVE-2019-6296

Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...

CVE-2019-6295

Cleanto 5.0 has SQL Injection via the assets/lib/servicemethodajax.php serviceid parameter...

Privilege Escalation

openstack-neutron is vulnerable to privilege escalation attacks. The vulnerability exists as the default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows...

Cleanto 5.0 - SQL Injection

Cleanto 5.0 - SQL Injection Exploit Title: Cleanto 5.0 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://skymoonlabs.com/ Software Link: https://codecanyon.net/item/appointment-booking-software-for-cleaning-maintenance-businesses-cleanto/18397969...

Cleanto 5.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Cleanto 5.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://skymoonlabs.com/ Software Link: https://codecanyon.net/item/appointment-booking-software-for-cleaning-maintenance-businesses-cleanto/18397969...

Cleanto 5.0 - SQL Injection

Exploit Title: Cleanto 5.0 - SQL Injection Dork: N/A Date: 2019-01-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://skymoonlabs.com/ Software Link: https://codecanyon.net/item/appointment-booking-software-for-cleaning-maintenance-businesses-cleanto/18397969 Version: 5.0 Category: Webapps...

WordPress <= 5.0 - Authenticated Post Type Bypass

Description According to WordPress: "Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input."...

CVE-2018-1935

IBM Connections versions 5.0, 5.5, and 6.0 are affected by an information disclosure vulnerability where an authenticated user can obtain sensitive information from invalid request error messages. Root cause details are not provided beyond the error-message behavior in the cited sources. Impact i...

Android 5.0 Battery Information Broadcast Information Disclosure

NOTE: This bug is part of a series of three related Android bugs with the same root cause: CVE-2018-9489, CVE-2018-9581 and CVE-2018-15835. A presentation covering all three bugs was given at BSides DE in the fall of 2018. SUMMARY System broadcasts by the Android operating system expose detailed...

AutoRDPwn v4.5 - The Shadow Attack Framework

AutoRDPwn is a script created in Powershell and designed to automate the Shadow attack on Microsoft Windows computers. This vulnerability allows a remote attacker to view his victim's desktop without his consent, and even control it on request. For its correct operation, it is necessary to comply...

CVE-2017-1609

IBM Rational Quality Manager (RQM) versions 5.0–5.0.2 and 6.0–6.0.6 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products/versions: Rational Quality Ma...

Security Bulletin: Security vulnerability affects Rational Engineering Lifecycle Manager

Summary Rational Engineering Lifecycle Manager is affected by a potential security vulnerability Vulnerability Details CVEID: CVE-2018-1846 DESCRIPTION: IBM RELM is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerabilit...

GHSA-G8HW-794C-4J9G Path Traversal in org.springframework:spring-core

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. When static resources are served from a file system on Windows as opposed to the classpath, or...

Denial of Service in org.springframework:spring-core

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...