CVE-2018-6569

West Wind Web Server 6.x is affected: the /ADMIN.ASP page can be accessed without authentication, allowing an attacker to perform actions with potential program execution, termination, data disclosure, or DoS as described in linked CVE records. This is supported by multiple sources (CVE-2018-6569...

OpenSSH 5.4 < 7.1p2 Multiple Vulnerabilities

According to its banner, the version of OpenSSH running on the remote host is 5.x prior to 5.4, 6.x or 7.x prior to 7.1p2. It is, therefore, affected by multiple vulnerabilities. - A potential information disclosure vulnerability which may allow remote servers to obtain sensitive information from...

CVE-2014-8540

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks...

JBOSSAS 5.x/6.x Deserializer Vulnerability

Exploit for java platform in category web applications JBOSSAS 5.x/6.x Deserializer Vulnerability https://access.redhat.com/security/cve/cve-2017-12149 CVE-2017-12149 It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it...

JBOSSAS 5.x/6.x 反序列化命令执行漏洞（CVE-2017-12149）

CVE-2017-12149 It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data. Find out more about CVE-2017-12149 from the MITRE CV...

CVE-2017-14357

HP ArcSight ESM and HP ArcSight ESM Express are affected by CVE-2017-14357: a Reflected and Stored Cross-Site Scripting (XSS) vulnerability in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. The issue could be exploited remotely to inject web scripts or HTML, enabling client-side scrip...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to tags in a rendered response...

Apache Solr XEE and RCE Vulnerability (SOLR-11477) - Windows

Apache Solr is vulnerable to an XML Entity Expansion XEE vulnerability leading to remote code execution RCE. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Solr XEE and RCE Vulnerability (SOLR-11477) - Linux

Apache Solr is vulnerable to an XML Entity Expansion XEE vulnerability leading to remote code execution RCE. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2017-13991

An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features...

Cross site scripting

A reflected Cross-Site ScriptingXSS vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows for unintended information when a specific URL is sent to the system...

Open redirect

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

CVE-2015-2749

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

CVE-2015-2749

CVE-2015-2749 is an open redirect vulnerability in Drupal. The affected software is Drupal 6.x prior to 6.35 and Drupal 7.x prior to 7.35. The vulnerability enables remote attackers to redirect users to arbitrary websites and potentially facilitate phishing through a destination parameter. Exploi...

CVE-2017-7276

There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7.x before 7.03.019...

Intel Active Management Technology - System Privileges

!/usr/bin/python -- coding: utf-8 -- Author: Nixawk CVE-2017-5689 = dork="Server: IntelR Active Management Technology" port:"16992", ports= 623, 664, 16992, 16993, 16994, 16995 products= Active Management Technology AMT, Intel Standard Manageability ISM, Intel Small Business Technology SBT versio...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1006)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The kexinputkexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service memory consumption b...

Authentication flaw

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...

Design/Logic Flaw

ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service infinite loop via a crafted MIFF file...

Design/Logic Flaw

The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service infinite loop via a crafted PDB file...