5995 matches found
CVE-2018-1000840
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...
Xxe
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...
CVE-2018-1000840
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...
CVE-2018-1000840
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity XXE vulnerability in loadXML function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use...
Squid 3.2.0.11 < 3.x < 3.5.18 / 4.x < 4.0.10 Cache Poisoning Vulnerability (SQUID-2016:7)
According to its banner, the version of Squid running on the remote host is 3.x after 3.2.0.11 and prior to 3.5.18, or 4.x prior to 4.0.10. It is, therefore, affected by a cache poisoning vulnerability in the handling of HTTP requests. Note that Nessus has not tested for this issue but has instea...
phpMyAdmin 4.8.4 - 'AllowArbitraryServer' Arbitrary File Read
!/usr/bin/env python coding: utf8 import socket import asyncore import asynchat import struct import random import logging import logging.handlers PORT = 3306 log = logging.getLoggername log.setLevellogging.DEBUG tmpformat = logging.handlers.WatchedFileHandler'mysql.log', 'ab'...
openSUSE Security Update : apache2-mod_jk (openSUSE-2018-1510)
This update for apache2-modjk fixes the following issue : Security issue fixed : - CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd bsc1114612. This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Securit...
RHEL 6 : Ruby on Rails (RHSA-2013:0153)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. Ruby on Rails is a modelviewcontroller MVC framework for web application development. Action Pack implements the controller and the view components...
Apache Tika Command Injection (CVE-2018-1335)
A command injection vulnerability exists in Apache Tika. The vulnerability is due to improper validation of the HTTP requests. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...
KeyBase Botnet 1.5 - SQL Injection
Exploit Title: KeyBase Botnet v1.5 - SQL Injection Vulnerability Google Dork: intitle:"KeyBase: Login" + intext:" Login to get access to your logs " Date: 3/12/2018 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Version: v1.5 Tested on: Windows 10, debian 7 CVE : n/a...
The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the insufficient protection of the website structure, which allows a hacker to inject arbitrary code into the web pages that users are asked to download.
The vulnerability of the Microsoft Dynamics 365 resource planning software application is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web pages uploaded to users, thereby gaining access to...
NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage
''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt + ISR: ApparitionSec Greetz: indoushka | Eduardo B. 0day Vendor www.necam.com Affected Product Code Base NEC...
CVE-2018-15537
Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...
CVE-2018-15537
Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...
CVE-2018-15537
Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...
Denial of Service Vulnerability in Multiple Schneider Electric Products (CNVD-2018-24634)
Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A denial of service vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by an attacker to cause a denial of service by sending ...
ZIP File Raider - Burp Extension For ZIP File Payload Testing
ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This extension helps to automate the extraction and compression...
Endpoint for Out-of-Band Exfiltration: Arecibo
In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band OOB techniques in order to exfiltrate information through DNS resolutions or HTTP requests. To address this kind of situation the faster and simpler solution can be the use of a Burp...
Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)
Title: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery Add Admin Author: Gjoko 'LiquidWorm' Krstic @zeroscience Exploit Date: 2018-11-17 Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0801DU HW6.0 BL1.5 FW7.23 WF7.4 Tested on:...
