UberFire: Information disclosure and RCE via insecure file upload/download servlets

It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gai...

Workbench: Insufficient authorization constraints

It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that...

UberFire: Information disclosure and RCE via insecure file upload/download servlets

It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gai...

Workbench: Insufficient authorization constraints

It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that...

AOL Search Reflected File Download

Oren Hafif reported a new kind of attack called Reflected File Download https://www.blackhat.com/eu-14/briefings.htmlreflected-file-download-a-new-web-attack-vector in Black Hat Europe 2014 conference. More details about the attack you can found in his public presentation:...

Wordpress Theme Divi Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Divi Arbitrary File Download Vulnerability Date: 08/02/2015 Exploit Author: pool and Fran73 Vendor Homepage: http://www.elegantthemes.com/gallery/divi/ Contact : email protected YM Tested on: Linux / Window Googl...

Threat Outbreak Alert RuleID13472: Email Messages Distributing Malicious Software on February 9, 2015

Medium Alert ID: 37396 First Published: 2015 February 9 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13472 may contain the following files: Name |...

Siemens Fixes Critical Flaws in Some WinCC Versions

More than two months after the original advisory went out, Siemens has released patches for a pair of critical vulnerabilities in some versions of its Simatic WinCC SCADA product that remained vulnerable. Both of the vulnerabilities are remotely exploitable and have potentially damaging...

ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities

Multiple vulnerabilities in FailOverServlet in ManageEngine OpManager, Applications Manager and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 28/01/2015 / Last updated: 09/02/20...

DES exposure checker - Arbitary File Download Vulnerability

DES exposure checker is a free web application, used to see how real DES images look. This vulnerability allow kind of user can to download a file from the distant server, like PHP files, TXT file, etc. Theory : http://SERVER/getImage.php?name=FILE.EXT Example :...

ManageEngine Multiple Products Arbitrary File Download Exploit

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...

Wordpress多个主题任意文件下载漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = '1679' vul ID version = '1' author = 'zhengdt' vulDate = '2014-10-06' createDate ...

ManageEngine File Download / Content Disclosure / SQL Injection

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...

Wordpress Video Gallery Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugins - Wordpress Video Gallery Arbitrary File Download Vulnerability Date: 17/01/2015 Exploit Author: X-Line Empire North From Tetouan Vendor Homepage: Dork : www.hdflvplayer.net Software Link:...

ManageEngine Multiple Products Arbitrary File Download

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

ManageEngine Multiple Products Arbitrary Directory Listing

This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linux or C:\ in Windows. This vulnerabilit...

74CMS 3.4 /plus/weixin.php 任意文件下载漏洞

No description provided by source...

Joomla ContusHDVideoShare com_contushdvideoshare - Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla component comcontushdvideoshare - Arbitrary File Download Vulnerability Google Dork: "comcontushdvideoshare" Date: 25/01/2015 Exploit Author: X-Line Empire North - Tetouan Vendor Homepage: Dork : www.hdflvplayer.net...

WordPress Revolution Slider Local File Disclosure

Title: Wordpress slider reolusion local file download + Date: 2015-01-25 + Author: JOK3R + Vendor Homepage: https://wordpress.org/plugins/patch-for-revolution-slider/ + Tested on: windows 7 / firefox , kali linux / firefox + Vulnerable Files: /plugins/revolution-slider/ + Dork : "Index of"...