CVE-2018-18547

Vesta Control Panel (VestaCP) up to version 0.9.8-22 is affected by a cross-site scripting (XSS) vulnerability. The issue arises from unsanitized input in multiple endpoints (edit/web/?domain=, list/backup/?backup=, list/rrd/?period=, list/directory/?dir_a=, and list/directory/ URIs), allowing an...

CVE-2018-18548

AjentiCP (Ajenti) up to version 1.2.23.13 contains a Cross-site Scripting (XSS) vulnerability in File Manager caused by mishandling a filename. The issue allows an attacker to inject JavaScript that can run in an Ajenti user’s browser, enabling potentially high-risk exploitation without privilege...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

VestaCP Cross-Site Scripting Vulnerability

VestaCP is a hosting control panel. A cross-site scripting vulnerability exists in VestaCP 0.9.8-22 and prior versions. A remote attacker can exploit this vulnerability to execute JavaScript code in a user's browser...

Vesta control panel servers infected with DDoS malware after supply chain attack

By Waqas An open-source hosting panel software provider, Vesta Control Panel VestaCP, has admitted that the company became a victim of a supply chain attack. In an announcement made by VestaCP on its forum, it was revealed that the hacker managed to contaminate the source code of its project with...

On Heels of Criticism, Newly-Released Google Chrome 70 Prioritizes Privacy

Google has lifted the curtain on its latest version of Chrome, which the tech giant has pledged touts more data privacy features, as well as fixes for high-priority vulnerabilities. The release comes after Google had promised updates in Chrome 70 to “better communicate our changes and offer more...

XAMPP Control Panel 3.2.2 - Denial of Service (PoC)

Exploit Title: XAMPP Control Panel 3.2.2 - Denial of Service PoC Exploit Author: Gionathan "John" Reale Date: 2018-09-14 Software: XAMPP Version: 3.2.2 / 7.2.9 Newest version at time of writing Download:...

KLA11320 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player. For details look at KLA11317. Original advisories ADV180023 Related products Microsoft-Windows Microsoft-Windows-Server CVE list KB list 4457146 Solution Install necessary updates from the KB section, that are listed in your...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19090)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in version 7.0.11 of idreamsoft iCMS. The vulnerability stems from the detection of CSRFTOKEN when it does not exist, and the program...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...

CVE-2018-16332

An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...

Physics Platform - A Remote Hardware Hacking Platform

Physics platform is a tool for hardware systems e.g: raspberryPi 3B . It retrieves data passing through the network and sends it to a control panel. It works the same way as a botnet by receiving remote commands. you can imagine that as a black box. Physics hardware You can check repository of...

CVE-2018-11502

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. An attacker can remotely delete all mod notes and mod note logs in the modCP and ACP via CSRF...

Microsoft Windows: Configure Solicited Remote Assistance

This policy setting allows you to turn on or turn off Solicited Ask for Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this...

Massive Malspam Campaign Finds a New Vector for FlawedAmmyy RAT

A widespread spam campaign from the well-known financial criminal group TA505 is spreading the FlawedAmmyy RAT using a brand-new vector: Weaponized PDFs containing malicious SettingContent-ms files. The SettingContent-ms file format was introduced in Windows 10; it allows a user to create...

Microsoft Windows: Always install with elevated privileges

This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system. If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user offered on the...

Microsoft Windows: Turn off Windows Customer Experience Improvement Program

This policy setting turns off the Windows Customer Experience Improvement Program. The Windows Customer Experience Improvement Program collects information about your hardware configuration and how you use our software and services to identify trends and usage patterns. Microsoft will not collect...

CVE-2018-12583

An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...

Security Bulletin: Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2017-5664)

Summary Apache Tomcat is vulnerable to a security issue affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE-ID: CVE-2017-5664 Description: Apache Tomcat could allow a remote attacker to bypass securi...

Security Bulletin: Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2016-6816)

Summary Apache Tomcat is vulnerable to a security issue affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE-ID: CVE-2016-6816 Description: Apache Tomcat is vulnerable to HTTP response splitting...