OTRS 4.x < 4.0.27, 5.x < 5.0.24, 6.x < 6.0.2 RCE Vulnerability (Dec 2017)

OTRS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrs"; if...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

FS IMDB Clone SQL Injection

Exploit Title: FS IMDB Clone - 'id' SQL Injection Date: 2017-12-06 Exploit Author: DanAdeg Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/imdb-clone/ Version: 2017-12-06 Tested on: Kali Linux 2.0 PoC: SQL Injection on GET parameter = id...

Cross site scripting

IBM DOORS Next Generation DNG/RRC 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2017-1560

IBM DOORS Next Generation (DNG/RRC) versions 4.0, 5.0 and 6.0 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The issue is documented across ...

OTRS RCE Vulnerability

OTRS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrs"; if...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - Directory Traversal

Description Input passed thru several parameters is not properly verified before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files from local resources with directory traversal attacks. Vendor Dalim Software GmbH - https://www.dalim.com Affecte...

FS Food Delivery Script - keywords SQL Injection

FS Food Delivery Script - keywords SQL Injection Exploit Title: FS Food Delivery Script - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/food-delivery/ Version: 23 October 17 Tested on: Kali Lin...

Complain Management System Hard-Coded Credentials / Blind SQL Injection

Exploit Title : Complain Management System Blind SQL Injection Date: 10 October 2017 Exploit Author: havysec Tested on: ubuntu14.04 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

Complain Management System - Hard-Coded Credentials / Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Complain Management System Blind SQL Injection Date: 10 October 2017 Exploit Author: havysec Tested on: ubuntu14.04 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

CVE-2017-1364

IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126857...

Cross site scripting

IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125975...

CVE-2017-1324

Summary: IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure in a trusted session. Root cause: Web UI input handling allows injection of ar...

CVE-2017-1369

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–6.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The issue stems from embedded arbitrary JavaScript in the UI, as described across multi...

Important kernel security update: CVE-2017-1000251 and other; new kernel 2.6.32-042stab125.1 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

This update provides the new kernel 2.6.32-042stab125.1 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0 based on the Red Hat Enterprise Linux 6.9 kernel 2.6.32-696.10.2.el6. This update inherits a security fix from the original RHEL kernel and provides internal security fixes...

inClick Cloud Server 5.0 SQL Injection

Exploit Title: inClick Cloud Server 5.0 - SQL Injection Dork: N/A Date: 12.09.2017 Vendor Homepage: http://www.inclick.net/ Software Link: http://www.inclick.net/pageid/demo.html Demo: http://www.inclick.net/pageid/demo.html Version: 5.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

inClick Cloud Server 5.0 - SQL Injection

inClick Cloud Server 5.0 - SQL Injection Exploit Title: inClick Cloud Server 5.0 - SQL Injection Dork: N/A Date: 12.09.2017 Vendor Homepage: http://www.inclick.net/ Software Link: http://www.inclick.net/pageid/demo.html Demo: http://www.inclick.net/pageid/demo.html Version: 5.0 Category: Webapps...

inClick Cloud Server 5.0 - SQL Injection

Exploit Title: inClick Cloud Server 5.0 - SQL Injection Dork: N/A Date: 12.09.2017 Vendor Homepage: http://www.inclick.net/ Software Link: http://www.inclick.net/pageid/demo.html Demo: http://www.inclick.net/pageid/demo.html Version: 5.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

CVE-2017-1338

CVE-2017-1338 affects IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0, with a cross-site scripting flaw in the Web UI that can let an attacker embed arbitrary JavaScript and potentially disclose credentials in a trusted session. The IBM bulletin lists fixes by upgrading to: 6.0.2 iFix013 or ...

Fortinet FortiManager SQL Injection Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and managemen...