CVE-2018-10682

CVE-2018-10682/10683 (WildFly 10.1.2.Final) : Red Hat entries provide concrete detail that an attacker could access the administration panel on TCP port 9990 without authentication via an optional, potentially unsecured anonymous access path, followed by a misconfiguration (auto-deployment) enabl...

PT-2018-10050 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly version 10.1.2.Final Description: An issue allows an attacker to access the administration panel without authentication using anonymous access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war...

zoomthe.me Improper Access Control vulnerability

Open Bug Bounty ID: OBB-614187 Description| Value ---|--- Affected Website:| zoomthe.me Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Mail.ru: Blind Stored XSS

Blind XSS in torg.mail.ru admin panel. torg.mail.ru is not currently covered by bug bounty program. Слепая ХСС вне скоупа, но затрагивающая аккаунты магазинов и админку...

Uber: Cleartext password exposure allows access to the desafio5estrelas.com admin panel

Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site...

WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting (PoC)

0x01 漏洞概述 Wordpress的插件WordPress File Upload v4.3.3及其以前版本在管理后台存在一处存储型xss漏洞。攻击者可以通过该漏洞执行js脚本，获取管理员cookie。 漏洞名称：WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting PoC 漏洞来源：https://www.exploit-db.com/exploits/44444/ CVE：CVE-2018-9844 影响组件：WordPress Plugin File Upload...

Cross site scripting

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

Nextcloud: Bruteforce in admin panel

Hello there, Admin panel of your website https://nextcloud.com/wp-login.php is vulnerable to bruteforce attacks as their is no rate-limiting. Impact Can gain access to admin panel. To fix this, Just add rate limiting...

iScripts UberforX Cross-Site Request Forgery Vulnerability

IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site request forgery vulnerability exists in the...

iScripts UberforX Cross-Site Scripting Vulnerability

IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site scripting vulnerability exists in the...

CVE-2018-10137

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

Cross site request forgery (csrf)

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

CVE-2018-10137

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

CVE-2018-10136

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

Cross site scripting

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

CVE-2018-10137

iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...

CVE-2018-10136

Vulnerability summary (CVE-2018-10136): iScripts UberforX 2.2 contains a Stored XSS in the Admin Panel under the “manage_settings” page, exploitable by injecting script via the value field in the URI /cms?section=manage_settings&action=edit. The Red Hat and CNVD entries corroborate the same issue...

CVE-2018-10136

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

CVE-2018-10137

CSRF in iScripts UberforX 2.2 Admin Panel: the issue is in the manage_settings section exposed at /cms?section=manage_settings&action=edit. CVSS3 base score 8.8 (HIGH); attack vector NETWORK, user interaction REQUIRED, impacts on C/I/A HIGH. No exploitation details are provided in the documents; ...