56 matches found
Kaseya Virtual System Administrator Code Execution / Privilege Escalation
Hi, I have found 3 vulnerabilities in Kaseya's flagship product: - unauthenticated remote code execution CVE-2015-6922 / ZDI-15-449 - unauthenticated remote privilege escalation CVE-2015-6922 / ZDI-15-448 - authenticated remote code execution CVE-2015-6589 / ZDI-15-450 Kaseya VSA is an IT...
Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (2)
Kaseya VSA is an IT management platform for small and medium corporates. From its console you can control thousands of computers and mobile devices. So that if you own the Kaseya server, you own the organisation. With this post I'm also releasing two Metasploit modules E1, E2 and a Ruby file E3...
Kaseya Virtual System Administrator (VSA) 7.0 9.1 - (Authenticated) Arbitrary File Upload
Kaseya Virtual System Administrator VSA 7.0 9.1 - Authenticated Arbitrary File Upload !/usr/bin/ruby kazPwn.rb - Kaseya VSA v7 to v9.1 authenticated arbitrary file upload CVE-2015-6589 / ZDI-15-450 =================== by Pedro Ribeiro / Agile Information Security Disclosure date: 28/09/2015 Usage...
CVE-2014-6589
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6590,...
CVE-2014-6589
CVE-2014-6589 affects Oracle VM VirtualBox prior to 4.3.20 via the VMSVGA virtual graphics device. The issue allows local attackers to impact integrity and availability. The vulnerability is part of a set of issues tied to VirtualBox’s VMSVGA handling; advisories and patches indicate upgrading to...
CVE-2012-6589
Cross-site scripting XSS vulnerability in search.php in MYRE Business Directory allows remote attackers to inject arbitrary web script or HTML via the look parameter...
CVE-2012-6589
CVE-2012-6589 Description: A cross-site scripting (XSS) vulnerability exists in MYRE Business Directory, specifically in search.php via the look parameter. Remote attackers could inject arbitrary web script or HTML. Affected component: MYRE Business Directory (search.php).Root cause: Unvalidated ...
CVE-2012-6589
creationtimestamp| type| source ---|---|--- 2012-11-14 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/22711...
Apache OFBiz <= 3.0.0 Multiple HTML Injection Vulnerabilities
Apache OFBiz is prone to multiple HTML injection vulnerabilities. Copyright C 2009 Christian Eric Edjenguele Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
CVE-2008-6589
CVE-2008-6589 affects LightNEasy “no database” (flat) 1.2.2 (and possibly SQLite 1.2.2). The issue is multiple XSS vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php. The connected documents provide the vul...
Debian: Security Advisory (DSA-1534-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DSA-1534-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2007-6589
CVE-2007-6589 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7. The jar protocol handler fails to update the origin when an inner URL parameter yields an HTTP redirect, enabling remote XSS via a jar: URI. No exploitation details are provided in the documents. Remediation: upgrad...
CVE-2006-6589
Cross-site scripting XSS vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project OFBiz and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCHSTRING parameter, a different issue than CVE-2006-6587. NOTE: some of these detai...
CVE-2006-6589
The CVE-2006-6589 entry tracks a cross-site scripting (XSS) vulnerability affecting the ecommerce/control/keywordsearch path in Apache OFBiz and Opentaps 0.9.3, enabling remote injection of script/HTML via the SEARCH_STRING parameter. Connected OpenVAS data confirms HTML injection issues for Open...