11958 matches found
WolfCMS 0.8.3.1 Cross Site Scripting
Description: WolfCMS v0.8.3.1 and before is vulnerable to cross site scripting in User Add module for parameter Name. Impacted URL is http://yourwebserverip/wolfcms/?/admin/user/add Payload used is "TestXSS Further details: https://github.com/wolfcms/wolfcms/issues/683 Already requested for CVE,...
Unauthorized Access Vulnerability in Super Star Huiya Digital Book Documentation Service System
Beijing Century Super Star Information Technology Development Limited Liability Company Super Star is one of the companies engaged in the digitization of paper materials and the production of electronic publications. An unauthorized access vulnerability exists in the Super Star Huiya Digital Book...
Path traversal
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress when the Uploads add-on is activated. This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php aka upload/submit page name and...
Tor Security Add-On Abruptly Killed by Mozilla Bug
Thanks to Mozilla letting an intermediate signing certificate expire, the Tor community was thrown into disarray over the weekend when the NoScript security add-on was suddenly killed for both Firefox and the Tor browser. A fix is available for Firefox, but the Tor issue continues. NoScript is a...
New Relic: Stored XSS firing at the "Add chart to note" popup
Hey team, I have long found that a request retrieving content for Add chart to note popup is XSS-vulnerable. The following Add to note popup F484252 retrieves its content via the following request: http GET...
Man-in-the-Middle
Mozilla Firefox, Firefox ESR and Thunderbird are vulnerable to man-in-the-middle attacks. A remote attacker can spoof add-on updates and obtain confidential information via leveraging possession of X.509 server certificates...
Denial Of Service (DoS)
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the...
CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting
Exploit Title: CentOS Web Panel - Domain Field Add DNS Zone Cross-Site Scripting Vulnerability Google Dork: N/A Date: 22 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.793 Free, v0.9.8.753 Pro and 0.9.8.807...
CVE-2019-11620
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user or a user with permission to manage modulecategory could exploit the vulnerability to obtain database sensitive information via...
Veeam ONE Reporter 9.5.0.3201 - Persistent Cross-site Scripting (Add/Edit Widget)
Exploit Title: Veeam ONE Reporter - Stored Cross-site Scripting Add/Edit Widget Exploit Author: Seyed Sadegh Khatami Website: https://www.cert.ir Date: 2019-04-27 Google Dork: N/A Vendor Homepage: https://www.veeam.com/ Software Link: https://www.veeam.com/virtual-server-management-one-free.html...
CMS Made Simple <= 2.2.12 Multiple Reflected XSS Vulnerabilities
CMS Made Simple is prone to multiple reflected cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
kernel: Integer overflow in the alarm_timer_nsleep function
A flaw was found in the alarmtimernsleep function in kernel/time/alarmtimer.c in the Linux kernel. The ktimeaddsafe function is not used and an integer overflow can happen causing an alarm not to fire or possibly a denial-of-service if using a large relative timeout...
PYSEC-2019-155
python-dbusmock before version 0.15.1 AddTemplate D-Bus method call or DBusTestCase.spawnservertemplate method could be tricked into executing malicious code if an attacker supplies a .pyc file...
DEBIAN-CVE-2015-1326
python-dbusmock before version 0.15.1 AddTemplate D-Bus method call or DBusTestCase.spawnservertemplate method could be tricked into executing malicious code if an attacker supplies a .pyc file...
CVE-2019-11451
whatsns 4.0 allows index.php?inform/add.html qid SQL injection...
74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User)
74CMS 5.0.1 - Cross-Site Request Forgery Add New Admin User Exploit Title: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user Date: 2019-04-14 Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: http://www.74cms.com/download/index.html Version: v5.0.1 CVE :...
74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User) Exploit
Exploit for php platform in category web applications Exploit Title: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: http://www.74cms.com/download/index.html Version: v5.0.1 CVE : CVE-2019-11374 74CMS...
74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User)
Exploit Title: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user Date: 2019-04-14 Exploit Author: ax8 Vendor Homepage: https://github.com/Li-Siyuan Software Link: http://www.74cms.com/download/index.html Version: v5.0.1 CVE : CVE-2019-11374 74CMS v5.0.1 has a CSRF vulnerability to add...
