WordPress Mirrorwp-Backups 4.8 Database Disclosure

Exploit Title : WordPress Mirrorwp-Backups 4.8 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 17/12/2018 Vendor Homepage : wordpress.org codecanyon.net/tags/wpmirror wpmirrorobj.com Software Download Link : N/A Tested On : Windows and...

CVE-2018-15328

On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the cle...

WordPress Simple-E-Commerce-Shopping-Cart 2.2.5 Database Disclosure

Exploit Title : WordPress Simple-E-Commerce-Shopping-Cart Plugins 2.2.5 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org/plugins/simple-e-commerce-shopping-cart/ Owner of the Script : Niaz Showke...

WordPress Simple-Forum 4.0 Database Disclosure

Exploit Title : WordPress Simple-Forum Plugins 4.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org simple-press.com Software Download Link : simple-press.com/downloads/simple-press-core-plugin/...

WordPress WP-Syntax Download Extension 1.1.1 Database Disclosure

Exploit Title : WordPress WP-Syntax Download Extension Plugins 1.1.1 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org/plugins/wp-syntax-download-extension/ +...

CVE-2018-16791

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...

CVE-2018-16792

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

iSmartAlarm Cube One Information Disclosure Vulnerability

The iSmartAlarm Cube One is a smart home center control device from iSmartAlarm USA. An information disclosure vulnerability exists in the diagnostic file in iSmartAlarm Cube One 2.2.4.10 and earlier versions, which stems from the program's failure to perform proper access control, and can be...

CVE-2018-18789

An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php...

CVE-2018-17447

An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4...

CVE-2018-11079

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain...

CVE-2018-1670

IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration information from log files. IBM X-Force ID: 144946...

CVE-2018-14957

CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggettodocumenti/../.././inc/config.php one can take the control of the application because credentials are present in that config.php file...

CirCarlife Scada Information Disclosure Vulnerability (CNVD-2018-19569)

CIRCONTROL CirCarLife is a parking lot automation management system from Circontrol, Spain. A security vulnerability exists in CIRCONTROL CirCarLife versions prior to 4.3 that stems from the program's lack of authentication of the /html/devstat.html file. A remote attacker could exploit the...

Node.js third-party modules: [takeapeek] Path traversal allow to expose directory and files

I would like to report Path Travelsal in takeapeek It allows attacker to list directory and files. Module module name: takeapeek version: 0.2.2 npm page: https://www.npmjs.com/package/takeapeek Module Description A simple static webserver with only one command. Heavily inspired by glance, this is...

Node.js third-party modules: List any file in the folder by using path traversal

I would like to report Path Traversal in simplehttpserver. It allows to list any file in another folder of web root. Module module name: simplehttpserver version: v0.2.1 npm page: https://www.npmjs.com/package/simplehttpserver Module Description 'simpehttpserver' is an simple imitation of python'...

CVE-2017-18345

The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...

DEBIAN-CVE-2017-16790

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to...

Design/Logic Flaw

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to...

CVE-2017-16790

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to...