HPE Intelligent Management powershellConfigContent Code Execution Vulnerability

HPE Intelligent Management Center is a suite of network intelligence management center solutions. A code execution vulnerability exists in the handling of the HPE Intelligent Management Center powershellConfigContent beanName parameter, which can be exploited by an attacker to submit a special...

Design/Logic Flaw

A log poisoning vulnerability has been discovered in the OneShield Policy Dragon Core framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging...

CVE-2019-11642

A log poisoning vulnerability has been discovered in the OneShield Policy Dragon Core framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging...

Remote Code Execution (RCE) Through Deserialization

Jackson-databind is vulnerable to remote code execution RCE attacks. These attacks are possible during bean deserialization. Using this flaw attackers are able to execute code and commands. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse = JsonTypeInfo.Id.CLASS or...

CVE-2018-18893

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...

The vulnerability of the templateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the templateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code with the parameter beanName...

Hewlett Packard Enterprise Intelligent Management Center sshConfig Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

Hewlett Packard Enterprise Intelligent Management Center iccSelectDymicParam Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-11355

Multiple cross-site scripting XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to the main page; the 2 beanReference parameter to the JavaBean viewer page; or the 3 pyTableName to the System database schema...

CVE-2016-6799

Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition...

SQL Injection Vulnerability in Multiple Parameters of Multiple Files of Dahua Alarm Operation and Management Platform Devices

Dahua Alarm Center Management Platform is a comprehensive system solution centered on alarm reception and processing. Dahua alarm operation and management platform equipment attachmentclearTempFile.action file of bean.recId parameter, attachmentgetAttList.action file of bean.recId parameter,...

Remote Code Execution (RCE) Through Deserialization

Jackson-databind is vulnerable to remote code execution attacks. These attacks are possible during bean deserialization and attackers are able to execute code and commands...

CVE-2016-2104

Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...

CVE-2016-2104

This CVE relates to multiple XSS vulnerabilities in Red Hat Satellite 5 (Spacewalk) where an attacker can inject arbitrary script/HTML via parameters such as label, package_name, search_subscribed_channels, channel_filter, or vectors like input:hidden /bean:message . The issue is documented acros...

Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts ClassLoader Manipulation Remote Code Execution',...

Mr Bean™ - Flying Teddy - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Mr Bean™ - Flying Teddy published at the 'play' market has multiple vulnerabilities...

Mr-Bean Surf - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Mr-Bean Surf published at the 'play' market has multiple vulnerabilities...

Killer Bean Unleashed - Dangerous filesystem permissions, Hardcoded secrets, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Killer Bean Unleashed published at the 'play' market has multiple vulnerabilities...

vanilla bean - vegan essen - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application vanilla bean - vegan essen published at the 'play' market has multiple vulnerabilities...