CVE-2018-19487

The CVE affects the WordPress WP-jobhunt plugin prior to version 2.4. The root cause is lack of access control for AJAX requests to cs_employer_ajax_profile() via admin-ajax.php, enabling remote unauthenticated attackers to enumerate user information. Practical impact is information disclosure ab...

CVE-2018-19487

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users...

Design/Logic Flaw

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

[SECURITY] Fedora 28 Update: guacamole-server-1.0.0-1.fc28

Guacamole is an HTML5 remote desktop gateway. Guacamole provides access to desktop environments using remote desktop prot ocols like VNC and RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No browser plugins are needed, and no clie...

phpBB 3.2.3 - Remote Code Execution Exploit

Exploit for php platform in category web applications phpBB 3.2.3 - Remote Code Execution Exploit // All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath =...

TeamCity < 9.0.2 - Disabled Registration Bypass Exploit

TeamCity 9.0.2 - Disabled Registration Bypass Exploit var login = 'testuser'; //логин пользователя var password = 'SuperMEgaPa$$'; //пароль var email = 'email protected'; // email / Code / var b = BS.LoginForm; var publickey = $F"publicKey"; var encryptedpass = BS.Encrypt.encryptDatapassword,...

FreeBSD : rt -- XSS via jQuery (416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42)

BestPractical reports : The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longe...

vBulletin 4.2.5 Ajax Threads 1.1.3 Lite Open Redirection

Exploit Title : vBulletin 4.2.5 Ajax Threads 1.1.3 Lite Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : vbulletin.com dragonbyte-tech.com Software Information Link : dragonbyte-tech.com/store/ajax-threads.114/ Softwa...

rt -- XSS via jQuery

BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...

Ultimate Membership Pro <= 7.5 - Arbitrary media upload

The ajax-upload.php endpoint doesn't check for the current user's capabilities or that they are even logged in, so we can do a few things we shouldn't be able to do: Without any credentials, you can simply POST the image file in the field ihcfile and it'll store it for you: $ curl -F...

Ultimate Membership Pro 7.4.2 <= 7.5 - Arbitrary media include

In addition to cropping/rotating/resizing an image of your choosing, you can abuse the imgUrl feature on versions that it's available on 7.4.2+ at least to make an HTTP request to any site you want. For example, by having it connect to a site you control, you can determine the IP address of the...

Path traversal

tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file jpg/jpeg/png via path traversal with the path parameter, through the saveimg action in ajaxcalls.php...

Path traversal

tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the getfile action in ajaxcalls.php...

Joomla Geommunity3es 1.4 SQL Injection

Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : nordmograph.com Software Download Link : nordmograph.com/extensions /index.php?option=comvirtuemart&view=productdetails...

C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection

Exploit Title: C4G Basic Laboratory Information System BLIS 3.4 - Multiples SQL Injection Date: 01/31/2019 Software Links/Project: https://github.com/C4G/BLIS | http://blis.cc.gatech.edu/index.php Version: C4G Basic Laboratory Information System v3.4 Exploit Author: Carlos Avila Category: webapps...

ZoneMinder SQL Injection Vulnerability (CNVD-2019-04687)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. SQL injection vulnerability exists in the ajax/status.php file in versions prior to ZoneMinder 1.32.3, which can be exploited by remote attackers to execute SQL commands with...

The vulnerability of Juniper Networks Junos Space, a platform for managing network resources, related to insufficient access control, allows attackers to delete information from the internal database.

The vulnerability of Juniper Networks’ Junos Space network resource management platform is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to delete information from the internal database using specially crafted Ajax requests...

GHSA-QMV4-JGP7-MF68 Sails before 0.12.7 vulnerable to Broken CORS

Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML...

Sails before 0.12.7 vulnerable to Broken CORS

Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML...