PT-2019-9539

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01 Description A stored XSS issue exists in the web interface, allowing authenticated attackers to inject JavaScript or HTML payload inside the ACL page. The injected payload is executed in a user's browser when the...

Titan FTP Server 2019 Build 3505 Directory Traversal

Discovered By: Kevin Randall on 3/23/2019 A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file through PreviewHandler.ashx by using a ....\ technique, arbitrary files can be loaded in the...

Command injection

Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management NSM 9.1 9.1.7.75 Update 4 and 9.2 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands...

CVE-2019-3606

CVE-2019-3606 affects McAfee Network Security Manager (NSM) in the web portal component when running NSM 9.x with versions prior to 9.1.7.75 Update 4 or 9.2.7.31 Update2. The issue enables data leakage by allowing administrators to view configuration information in plain text via the GUI or GUI t...

CVE-2019-3597

The CVE-2019-3597 entry applies to McAfee Network Security Manager (NSM) 9.1 and 9.2 branches. Affected: NSM versions < 9.1.7.75.2 and

CVE-2019-3597 Authentication bypass in McAfee Network Security Manager 9.x

Authentication Bypass vulnerability in McAfee Network Security Manager NSM 9.1 9.1.7.75.2 and 9.2 9.2.7.31 9.2 Update 2 allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions...

Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion

Exploit Title: Titan FTP Server Version 2019 Build 3505 Directory Traversal/Local File Inclusion Google Dork: N/A Date: 3/26/2019 Exploit Author: Kevin Randall Vendor Homepage: https://titanftp.com/ Software Link: https://titanftp.com/download Version: Firmware: Titan FTP Server Version 2019 Buil...

PT-2019-16635

Name of the Vulnerable Software and Affected Versions McAfee Network Security Management NSM versions 9.1 through 9.1.7.75 Update 4 McAfee Network Security Management NSM versions 9.2 through 9.2.7.31 Update2 Description The issue allows administrators to view configuration information in plain...

CVE-2019-3597: Undefined Security Weakness

Authentication Bypass vulnerability in McAfee Network Security Manager NSM 9.1 9.1.7.75.2 and 9.2 9.2.7.31 9.2 Update 2 allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions...

CVE-2019-3606: Cleartext Storage of Sensitive Information

Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management NSM 9.1 9.1.7.75 Update 4 and 9.2 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands...

Astra Linux fly-dm System Session Data Compromise Unauthorized Alteration

The vulnerability of the graphical user input component in the fly-dm system of the Astra Linux operating system is related to an error that causes the fly-mac-dialog component to be executed without the required DBUSSESSIONBUSADDRESS=nothing option. This option is necessary for executing the dbu...

Exploit for Path Traversal in Rarlab Winrar

CVE-2018-20250-WINRAR-ACE-G...

Legion - An Easy-To-Use, Super-Extensible And Semi-Automated Network Penetration Testing Tool That Aids In Discovery, Reconnaissance And Exploitation Of Information Systems

Legion, a fork of SECFORCE's Sparta, is an open source, easy-to-use, super-extensible and semi-automated network penetration testing framework that aids in discovery, reconnaissance and exploitation of information systems. Legion is developed and maintained by GoVanguard. More information about...

Semi-Automated Network Penetration Testing Framework: Legion

Legion, a fork of SECFORCE’s Sparta, is an open source, easy-to-use, super-extensible and semi-automated network penetration testing framework that aids in discovery, reconnaissance and exploitation of information systems. Legion is developed and maintained by GoVanguard. Features Automatic recon...

50m-ctf: Various vulnerabilities ultimately lead to attacker control over FliteThermostat server and access to internal accounting application source code

Step 1: The Entry Point 3:50 PM PST, Tuesday Afternoon F434398 This image is the entrypoint for the 50m-ctf. It doesn't look like much at first, but one can clearly see that there's a lot of binary digits in the background. The immediate obstacle to trying to decode it is we don't know how many...

First look at Tenable.io Web Application Scanner (WAS)

When Tenable firstly announced Web Application Security scanner as a part of their new Tenable.io platform, it was quite intriguing. Certainly, they already had some WAS functionality before in Nessus. For example, path traversal check was pretty good. But this functionality was quite fragmental...

Notepad++: Command injection by setting a custom search engine

Summary: Arbitrary commands can be injected when using the "Search on Internet" function with a malicious custom search engine. The custom search engine can be set through the GUI or the config files, with different attack scenarios. Description: The "Search on Internet" context menu functionalit...

PT-2019-1487

Name of the Vulnerable Software and Affected Versions Pelco Sarix Enhanced Camera affected versions not specified Description A Command Injection issue exists in the web-based GUI of the Pelco Sarix Enhanced Camera, potentially allowing a remote attacker to execute arbitrary commands. The...

PT-2019-1485

Name of the Vulnerable Software and Affected Versions Pelco Sarix Enhanced Camera affected versions not specified Description A Permissions, Privileges, and Access Control issue exists in the web-based GUI of the Pelco Sarix Enhanced Camera, allowing a remote attacker to delete an arbitrary file...

Volatility Workbench - A GUI For Volatility Memory Forensics

Volatility Workbench is a graphical user interface GUI for the Volatility tool. Volatility is a command line memory analysis and forensics tool for extracting artifacts from memory dumps. Volatility Workbench is free, open source and runs in Windows. It provides a number of advantages over the...