Privilege Escalation

cfme is vulnerable to privilege escalation attacks. The vulnerability exists as it was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on...

Anti-Spoofing Controls Bypass

openstack-neutron is vulnerable to anti-spoofing controls bypass. Authenticated users using the ML2 plugin or the security groups AMQP API are able to set the deviceowner field to an arbitrary value starting with network: on networks they do not own. Setting the affected field before the security...

DEBIAN-CVE-2018-4181

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions...

CVE-2018-16197

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device...

Joomla Codextrous B2jcontact 2.1.17 Shell Upload

Exploit Title : Joomla Codextrous ComB2jcontact Components 2.1.17 Shell Upload Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 04/01/2019 Vendor Homepage : codextrous.com/joomla-components/b2j-contact.html + extensions.joomla.org/extension/b2j-contact/ Software...

SUSE SLES12 Security Update : php7 (SUSE-SU-2018:1176-1)

This update for php7 fixes the following issues: Security issues fixed : - CVE-2018-10545: Fix access controls in FPM child processes bsc1091367. - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages bsc1091362. - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c...

Typo3 CMS pw_highslide_gallery 0.3.1 Database Disclosure

Exploit Title : Typo3 CMS pwhighslidegallery Extension 0.3.1 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org Software Download Link : extensions.typo3.org/extension/download/pwhighslidegallery/0.3.1/zip/...

Typo3 CMS twwc_pages 8.7.x Database Disclosure

Exploit Title : Typo3 CMS twwcpages Extension 8.7.x Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org Software Download Link : gosign.de/typo3-extension/twwcpages/ Tested On : Windows and Linux Category :...

PrestaShop yllyaidechantier 1.4.9.0 Database Disclosure

Exploit Title : PrestaShop yllyaidechantier Modules 1.4.9.0 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : prestashop.com Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...

Drupal 7 CivicRM 5.8.2 Database Disclosure

Exploit Title : Drupal 7 CivicRM Modules 5.8.2 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : drupal.org - civicrm.org Software Download Link : download.civicrm.org/civicrm-5.8.2-drupal.tar.gz +...

PrestaShop PM_AdvancedTopMenu 1.4.6.2 Database Disclosure / SQL Injection

Exploit Title : PrestaShop PMAdvancedTopMenu 1.4.6.2 Database Disclosure and SQL Injection Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : prestashop.com Software Download Link :...

ITAdvisorsNepal 9Qube Testimonials 1.0 Database Disclosure

Exploit Title : ITAdvisorsNepal 9Qube Testimonials Modules 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 17/12/2018 Vendor Homepage : itadvisorsnepal.com 9qube.com Software Download Link : N/A Tested On : Windows and Linux Category...

WordPress Lumise 4.9 Database Disclosure

Exploit Title : WordPress Lumise Plugins 4.9 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 17/12/2018 Vendor Homepage : wordpress.org sequelpro.com lumise.com + codecanyon.net/category/wordpress?tags=lumise Software Download Link :...

Code injection

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

CVE-2018-19413

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

CVE-2018-19413

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

Input validation

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017...

CVE-2018-1813

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017...

CVE-2018-1813

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017...

CVE-2018-1813

CVE-2018-1813 affects IBM Security Access Manager Appliance (versions 9.0.1.0–9.0.5.0). Description indicates the vulnerability stems from incomplete blacklisting during input validation, enabling attackers to bypass application controls and directly impact system and data integrity. Connected IB...