tomcat: Open redirect in default servlet

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a specially crafted URL could be used to cause the redirect to be generated to any URI of the...

Microsoft Internet Explorer Remote Security Bypass Vulnerability

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote security bypass vulnerability exists in Microsoft IE 10 and 11. A remote attacker could exploit the vulnerability by leveraging a specially crafted URL and...

PilusCart 1.4.1 Cross Site Request Forgery

Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 10-03-2019 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://github.com/piluscart Software Link:...

PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery Add Admin Exploit Author: Gionathan "John" Reale Vendor Homepage: https://github.com/piluscart Software Link:...

PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)

PilusCart 1.4.1 - Cross-Site Request Forgery Add Admin Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 10-03-2019 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://github.com/piluscart Software Link:...

PT-2019-1640

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description A security feature bypass issue exists due to Internet Explorer's failure to validate the correct Security Zone for specific URLs. This could allow an attacker to cause a user to...

Palo Alto Networks 7.1.x < 7.1.22 / 8.0.x < 8.0.15 / 8.1.x < 8.1.6 Cross-Site Scripting Vulnerability (PAN-SA-2019-0001)

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.22 or 8.0.x prior to 8.0.15 or 8.1.x prior to 8.1.6. It is, therefore, affected by a cross-site scripting XSS vulnerability that exists in the PAN-OS external dynamic lists due to improper validation of...

PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)

Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 10-03-2019 Exploit Author: Gionathan "John" Reale Vendor Homepage: https://github.com/piluscart Software Link:...

Information disclosure

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...

CVE-2019-9636

Removed by vendor...

Race condition

Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition...

CVE-2019-6551

Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition...

CVE-2019-6551

Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition...

CVE-2019-6551: Authentication Bypass Using an Alternate Path or Channel

Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition...

PT-2019-18162

Name of the Vulnerable Software and Affected Versions Pangea Communications Internet FAX ATA versions 3.1.8 and prior Description The issue allows an attacker to bypass user authentication by using a specially crafted URL, causing the device to reboot. This can lead to a continual denial-of-servi...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to upload arbitrary files to the system. IBM X-Force ID: 155008...

CVE-2018-20242

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking...

DEBIAN-CVE-2018-1000998

FreeBSD CVSweb version 2.x contains a Cross Site Scripting XSS vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This...

CVE-2018-1000998

FreeBSD CVSweb version 2.x contains a Cross Site Scripting XSS vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This...

CVE-2018-1000998: Improper Neutralization of Input During Web Page Generation

FreeBSD CVSweb version 2.x contains a Cross Site Scripting XSS vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This...