EyesOfNetwork 5.1 - Authenticated Remote Command Execution

EyesOfNetwork 5.1 - Authenticated Remote Command Execution Exploit Title: EyesOfNetwork 5.1 - Authenticated Remote Command Execution Google Dork: N/A Date: 2019-08-14 Exploit Author: Nassim Asrir Vendor Homepage: https://www.eyesofnetwork.com/ Software Link:...

The vulnerability of the Event Management Service daemon (emsd) on the Cisco IOS XR operating system allows a hacker to trigger a service failure.

The vulnerability of the Event Management Service daemon emsd on the Cisco IOS XR operating system is related to insufficient validation of input data during gRPC requests. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted gRPC requests...

Event Management Tickets Booking By Event Monster <= 1.0.5 - Stored XSS

The Event Management Tickets Booking By Event Monster WordPress plugin was affected by a Stored XSS security vulnerability...

WordPress Event Management Tickets Booking plugin <= 1.0.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Admavidhya N in WordPress Event Management Tickets Booking plugin versions = 1.0.5. Solution Update the WordPress Event Management Tickets Booking plugin to the latest available version at least 1.0.6...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XR Software is affected by following vulnerability : - A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

Design/Logic Flaw

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

School Event Management System SQL Injection Vulnerability

School Event Management System is a school event management system. A SQL injection vulnerability exists in School Event Management System version 1.0, which can be exploited by remote attackers to view, add, modify or delete information in the back-end database by sending the 'id' parameter to t...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18793

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18793

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Sql injection

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

Design/Logic Flaw

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18793

CVE-2018-18793 affects School Event Management System 1.0. The vulnerability is an Arbitrary File Upload through the endpoint event/controller.php?action=photos, enabling uploading of arbitrary files via the photos handler. Public exploits and shell-upload references exist (Exploit-DB, PacketStor...

CVE-2018-18794

The CVE-2018-18794 entry corresponds to a Cross-Site Request Forgery (CSRF) vulnerability in School Event Management System 1.0. Public documents detail CSRF via user/controller.php?action=edit and related admin-update flows. Exploitation evidence shows abuse of session state (checking ACCOUNT_ID...

CVE-2018-18795

CVE-2018-18795 corresponds to a SQL Injection vulnerability in School Event Management System 1.0. The flaw is triggered via the id parameter in the pages student/index.php and event/index.php, allowing an attacker to manipulate the backend database. Connected sources corroborate the same descrip...