CVE-2017-1000028

Removed by vendor...

Directory Traversal

web-debug is vulnerable to path traversal attacks. An attacker can access any files in the host machine by sending a HTTP GET request with /../ in it to obtain sensitive files such as /../../etc/passwd...

Easy File Sharing Web Server 7.2 - GET 'PassWD' Remote Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: Easy File Sharing Web Server 7.2 - GET HTTP Request PassWD Buffer Overflow SEH Date: 19 June 2017 Exploit Author: clubjk Author Contact: [email protected] Vendor Homepage: http://www.sharing-file.com Software Link:...

A vulnerability in the web console of the Antivirus Casper 8.0 anti-virus software allows for the transfer of JavaScript code executed by the client browser.

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers relates to the execution of scripts across sites. Exploiting this vulnerability allows a malicious actor to inject JavaScript code through a specially crafted GET request, with the JavaScript code specified in the...

Information disclosure

IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667...

CVE-2017-1193

IBM Sterling B2B Integrator Standard Edition 5.2 is affected by CVE-2017-1193, enabling a user to obtain sensitive information through an HTTP GET request due to improper access controls. The IBM Security Bulletin for CVE-2017-1193 (and related CVE-2017-1302) lists 5.2.6/5.2.x as affected and pro...

CVE-2017-9774

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

CVE-2017-9774

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

CVE-2017-9774

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

Authentication flaw

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

CVE-2017-9774

Remote Code Execution was found in HordeImage 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication...

D-Link DIR-605L Denial of Service Vulnerability

D-Link DIR-605L is a cloud router product from AUO D-Link. A denial of service vulnerability exists in the D-Link DIR-605L using firmware versions prior to 2.08UIBetaB01.bin. An attacker can exploit the vulnerability by sending a specially crafted GET request to cause the device to reboot...

EFS Easy Chat Server 3.1 - Password Disclosure

EFS Easy Chat Server 3.1 - Password Disclosure Exploit Title: Easy Chat Server Remote Password Disclosure Date: 09/10/2017 Software Link: http://echatserver.com/ecssetup.exe Exploit Author: Aitezaz Mohsin Vulnerable Version: v2.0 to v3.1 Vulnerability Type: Pre-Auth Remote Password Disclosure...

HTML Injection

concrete5 is vulnerable to HTML injection. If there is no canonical URL defined during setup, a malicious user can initiate a GET request with any domain name in the HOST header, allowing for arbitrary domains to be set for certain links. It can also act as a potential vector for cross-site...

CVE-2017-9026

Stack buffer overflow in vshttpd aka ioos in HooToo Trip Mate 6 TM6 firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request...

CVE-2017-9026

Stack buffer overflow in vshttpd aka ioos in HooToo Trip Mate 6 TM6 firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request...

Stack overflow

Stack buffer overflow in vshttpd aka ioos in HooToo Trip Mate 6 TM6 firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request...

CVE-2017-9026

Stack buffer overflow in vshttpd aka ioos in HooToo Trip Mate 6 TM6 firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request...

Sitecore CMS 8.2 - Cross-Site Scripting / Arbitrary File Disclosure

Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: [email protected] Vendor Homepage: http://www.sitecore.net/ Disclaimer: Everything mentioned below is for educational puposes...

Directory traversal

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...