ManageEngine ServiceDesk Plus 9.3 - User Enumeration

ManageEngine ServiceDesk Plus 9.3 - User Enumeration Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Date: 2019-03-29 Exploit Author: Operat0r Vendor Homepage: https://www.manageengine.com/ Software Link:...

Georgia Tech Data Breach Exposes 1.3 Million Users' Personal Data

The Georgia Institute of Technology, well known as Georgia Tech, has confirmed a data breach that has exposed personal information of 1.3 million current and former faculty members, students, staff and student applicants. In a brief note published Tuesday, Georgia Tech says an unknown outside...

BigTree CMS 'parent' SQL Injection Vulnerability

BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in BigTree CMS 'parent'. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2018-19201

A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter...

Design/Logic Flaw

A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code...

CVE-2018-18845

Summary of CVE-2018-18845 (Advanced Comment System): The affected product is Advanced Comment System, version 1.0. The vulnerability is a reflected cross-site scripting (XSS) flaw in internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php via ACS_path. A remote, ...

iWebShop open source mall system has xss vulnerability

iWebShop is a PHP language and MYSQL database based on the development of B2B2C single-user and multi-user open source mall system . iWebShop has an xss vulnerability that can be exploited by attackers to obtain an administrator cookie...

CVE-2019-9617

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...

Code injection

PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions...

Logic Flaw Vulnerability in Cloud Premium CMS

YUNUCMS YUNUCMS is a professional marketing enterprise building system based on PHP + MYSQL as the core development. YUNUCMS has a logic flaw vulnerability, which can be exploited by attackers to overstep their rights and add administrator accounts...

Micro Focus Filr Path Traversal Vulnerability

Micro Focus Filr is a file access and sharing solution for businesses. A path traversal vulnerability exists in the web application component of Micro Focus Filr prior to version 3.0 Security Update 6. An attacker could exploit this vulnerability to download arbitrary files from the Filr server...

Smule: Error Page Content Spoofing or Text Injection

Description: -------------- Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, a...

CVE-2019-7753

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

NUUO NVRmini upgrade_handle.php Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini upgradehandle.php Remote Command Execution', 'Description' = %q This exploits a vulnerability in the web application of NUUO NVRmini...

Timing Attack

redis-commander is vulnerable to timing attack. A remote attacker is able to perform password guessing by analyzing the response time of the application during password validation...

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the XML Publisher component in the PeopleSoft Enterprise PeopleTools business application suite is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP protocol...

Roxy Fileman 1.4.5 - Arbitrary File Download

Exploit Title: Roxy Fileman 1.4.5 - Arbitrary File Download Dork: N/A Date: 2019-01-16 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php Version: 1.4.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE:...

hollandhall.org XSS vulnerability

Open Bug Bounty ID: OBB-718773 Description| Value ---|--- Affected Website:| hollandhall.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

toydango.com XSS vulnerability

Open Bug Bounty ID: OBB-713767 Description| Value ---|--- Affected Website:| toydango.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

sejaatrevido.com XSS vulnerability

Open Bug Bounty ID: OBB-711655 Description| Value ---|--- Affected Website:| sejaatrevido.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...