PT-2019-15402

Name of the Vulnerable Software and Affected Versions ClonOS WEB control panel version 19.09 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the lang parameter in the "index.php" file. Recommendations For ClonOS WEB control panel version...

Ajenti Remote Command Execution Vulnerability

Ajenti is a web control panel written in python and angularjs. Ajenti suffers from a remote command execution vulnerability. An attacker can execute commands on a local monitoring server while testing...

Ajenti 2.1.31 - Remote Code Execution

Ajenti 2.1.31 - Remote Code Execution Title: Ajenti 2.1.31 - Remote Code Execution Author: Jeremy Brown Date: 2019-10-13 Software Link: https://github.com/ajenti/ajenti CVE: N/A Tested on: Ubuntu Linux !/usr/bin/python ajentix.py Ajenti Remote Command Execution Exploit ------- Details -------...

Ajenti 2.1.31 - Remote Code Execution

Title: Ajenti 2.1.31 - Remote Code Execution Author: Jeremy Brown Date: 2019-10-13 Software Link: https://github.com/ajenti/ajenti CVE: N/A Tested on: Ubuntu Linux !/usr/bin/python ajentix.py Ajenti Remote Command Execution Exploit ------- Details ------- Ajenti is a web control panel written in...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Cross site request forgery (csrf)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16993

CVE-2019-16993 affects phpBB

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Session Token In URL

PhpBB sends the session token via a GET parameter in the URL. Due to the way phpbb works, having the session ID is not enough for a remote attacker to gain access to the application since the session tokens are tied to an IP address. However, with knowledge of the administrator's session ID, the...

PT-2019-14914

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.1.7-PL1 Description The issue concerns improper verification of a CSRF token on the BBCode page in the Administration Control Panel. This could potentially allow for a CSRF attack if an attacker also obtains the sessi...

CVE-2019-16993: Cross-Site Request Forgery (CSRF)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

SecurityNotFound - 404 Page Not Found Webshell

Clone me! Clone or download the project: git clone https://github.com/CosasDePuma/SecurityNotFound.git SecurityNotFound cd SecurityNotFound "Installation" The src/404.php file should be located on the target server. That server must have the ability to execute .php files. Here is an example of so...

CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

Cross site request forgery (csrf)

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS...

KLA11565 DoS vulnerability in MS Windows

Unspecified vulnerability was found in MS Windows. Malicious users can exploit this vulnerability to cause denial of service. Original advisories CVE-2019-1255 Exploitation Related products Microsoft-Windows Windows-Defender CVE list CVE-2019-1255 unknown KB list Solution Install necessary update...

Cross site request forgery (csrf)

An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF...

ClonOS WEB control panel SQL Injection Vulnerability

ClonOS is an open source platform based on FreeBSD. The platform is mainly used for the creation and management of virtual environments. web control panel is one of the web-based ClonOS control panel. An SQL injection vulnerability exists in the clonos.php file in versions of WEB control panel...