CVE-2019-0303

CVE-2019-0303 affects SAP BusinessObjects BI Platform Administration Console (versions 4.2 and 4.3) where the BILogon/appService.jsp redirects reflect the requested errMsg parameter into the response without sanitization, enabling potential cross-site scripting when the URL is accessed. Related c...

CVE-2019-4381

IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API to interface with the HMC. An attacker could exploit this vulnerability to obtain HMC credentials. IBM X-Force ID: 162159...

Intel RAID Web Console 3 Input Validation Error Vulnerability

Intel RAID Web Console 3 RWC3 is a Web-based application from Intel Corporation that provides monitoring, maintenance, troubleshooting, and configuration capabilities for Intel RAID products. Intel RAID Web Console 3 suffers from an input validation error vulnerability that stems from the program...

PT-2019-2395 · Intel · Intel Raid Web Console 3

Name of the Vulnerable Software and Affected Versions: Intel RAID Web Console 3 RWC3 versions 4.186 and before Description: The issue is related to insufficient session validation in the service API, which may allow an unauthenticated user to potentially enable escalation of privilege via network...

RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift-web-console (RHSA-2019:1422)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1422 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

Intel® RAID Web Console 3 for Windows* Advisory

Summary: A potential security vulnerability in the Intel® RAID Web Console 3 RWC3 for Windows may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-11119 Description: Insufficient session validation ...

Authentication flaw

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability,...

CVE-2018-19999

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability,...

Bloodhound walkthrough. A Tool for Many Tradecrafts

A walkthrough on how to set up and use BloodHound BloodHound is an application used to visualize active directory environments. The front-end is built on electron and the back-end is a Neo4j database, the data leveraged is pulled from a series of data collectors also referred to as ingestors whic...

Commvault Web Console Detection

Binary data commvaultwebconsoledetect.nbin...

IBM PureApplication System Information Disclosure Vulnerability (CNVD-2019-44944)

IBM PureApplication System is a platform system from IBM USA designed for transactional Web and database applications. The system is capable of handling workloads and can be maintained and updated from a single console for all configurations. An information disclosure vulnerability exists in IBM...

CVE-2018-5405

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of oth...

CVE-2017-14852

An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The attack allows for an eavesdropper to capture the communication and decrypt the data...

Cross site scripting

All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside of SiteOmat, to a...

KACE System Management Appliance (SMA) 9.0.270 - Multiple Vulnerabilities

KACE System Management Appliance SMA 9.0.270 - Multiple Vulnerabilities Exploit Title: Dell Kace Appliance Multiple Vulnerabilities Date: 12/04/2018 Exploit Author: SlidingWindow, Twitter: @kapilkhot Vendor Homepage: https://www.quest.com/products/kace-systems-management-appliance/ Affected...

Zimbra Collaboration Server Cross-Site Scripting Vulnerability

Zimbra Collaboration Server ZCS is a suite of email and collaboration solutions from Zimbra, USA. The solution provides email, contacts, calendaring, file sharing, social networking, and more. A cross-site scripting vulnerability exists in the admin console in version 8.x of Zimbra ZCS prior to...

Design/Logic Flaw

Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console...

CVE-2015-2230

Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console...

CVE-2015-2230

CVE-2015-2230 affects Synacor Zimbra Collaboration Server 8.x prior to 8.7.0, where the admin console is vulnerable to a reflected cross‑site scripting (XSS) flaw. The issue arises from improper handling of user-supplied input in the admin console, allowing an attacker to execute client-side scri...

Oracle Application Testing Suite - WebLogic Server Administration Console War Deployment (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Application Testing Suite WebLogic Server Administration Console War Deployment', 'Description' = %q This module abuses a feature in...