dotCMS 5.1.1 - HTML Injection

dotCMS 5.1.1 - HTML Injection Exploit Title: dotCMS 5.1.1 - HTML Injection Date: 2019-05-09 Exploit Author: Ismail Tasdelen Vendor Homepage: https://dotcms.com/ Software Link: https://github.com/dotCMS Software: dotCMS Product Version: 5.1.1 Vulernability Type: Code Injection Vulenrability: HTML...

dotCMS 5.1.1 - HTML Injection Vulnerability

Exploit for jsp platform in category web applications Exploit Title: dotCMS 5.1.1 - HTML Injection Exploit Author: Ismail Tasdelen Vendor Homepage: https://dotcms.com/ Software Link: https://github.com/dotCMS Software: dotCMS Product Version: 5.1.1 Vulernability Type: Code Injection Vulenrability...

RICOH SP 4510DN Printer - HTML Injection

RICOH SP 4510DN Printer - HTML Injection Exploit Title: RICOH SP 4510DN Printer - HTML Injection Date: 2019-05-06 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/single-function-printers/sp-4520dn.htm...

RICOH SP 4520DN Printer - HTML Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: RICOH SP 4520DN Printer - HTML Injection Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/single-function-printers/sp-4520dn.ht...

dotCMS 5.1.1 - HTML Injection

Exploit Title: dotCMS 5.1.1 - HTML Injection Date: 2019-05-09 Exploit Author: Ismail Tasdelen Vendor Homepage: https://dotcms.com/ Software Link: https://github.com/dotCMS Software: dotCMS Product Version: 5.1.1 Vulernability Type: Code Injection Vulenrability: HTML Injection and Cross-site...

RICOH SP 4520DN Printer - HTML Injection

Exploit Title: RICOH SP 4520DN Printer - HTML Injection Date: 2019-05-06 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link: https://www.ricoh-europe.com/products/office-printers-fax/single-function-printers/sp-4520dn.html Software: RICOH Printer Product Version...

Code injection

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code...

Code injection

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi. A remote, unauthenticated attacker can use this vulnerability to start, stop, and disconnect active slideshows...

CVE-2019-3934

CVE-2019-3934 affects Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2). A crafted HTTP POST to login.cgi bypasses the presentation code, enabling a remote, unauthenticated attacker to download the current slide image without the access code. The available sources describe the affe...

CVE-2019-3934: Improper Access Control

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code...

PT-2019-16788

Name of the Vulnerable Software and Affected Versions Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description The issue allows a remote, unauthenticated attacker to bypass the presentation code by sending a crafted HTTP POST request to "login.cgi". This enables the attacker to...

Barco WePresent file_transfer.cgi Command Injection

This module exploits an unauthenticated remote command injection vulnerability found in Barco WePresent and related OEM'ed products. The vulnerability is triggered via an HTTP POST request to the filetransfer.cgi endpoint. Module Options msf use exploit/linux/http/wepresent/cmdinjection msf...

CVE-2018-16216

A command injection missing input validation, escaping in the monitoring or memory status web interface in AudioCodes 405HD firmware 2.2.12 VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands like starting telnetd or opening a reverse shell...

Apache Solr 5.x <= 5.5.5 or 6.x <= 6.6.5 Deserialization Vulnerability

The version of Apache Solr running on the remote web server is affected by a remote code execution vulnerability in the Config API due to unsafe deserialization of Java objects. An unauthenticated, remote attacker can exploit this, via an HTTP POST request that points the JMX server to a maliciou...

CVE-2018-19934

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting XSS in the Web management interface via URL path and HTTP POST parameter...

Cross site scripting

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting XSS in the Web management interface via URL path and HTTP POST parameter...

cutt.us Cross Site Scripting vulnerability OBB-775618

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| cutt.us ---|--- Open Bug Bounty Program...

uliege.be Cross Site Scripting vulnerability OBB-773645

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| uliege.be ---|--- Open Bug Bounty...

PT-2019-9947

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U FTP Server version 15.1.6.25 Description The issue concerns reflected cross-site scripting XSS in the Web management interface. This occurs via the URL path and an HTTP POST parameter. Recommendations For SolarWinds Serv-U FT...

CVE-2018-19934: Improper Neutralization of Input During Web Page Generation

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting XSS in the Web management interface via URL path and HTTP POST parameter...