PT-2018-6675

Name of the Vulnerable Software and Affected Versions: Atlassian Application Links versions prior to 5.2.7 Atlassian Application Links versions 5.3.0 through 5.3.3 Atlassian Application Links versions 5.4.0 through 5.4.2 Description: The issue allows remote attackers with administrative rights to...

CVE-2017-18096: Server-Side Request Forgery (SSRF)

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.

Paperclip gem provides multiple ways a file can be uploaded to a web server. The vulnerability affects two of Paperclip’s IO adapters that accept URLs as attachment data UriAdapter and HttpUrlProxyAdapter. When these adapters are used, Paperclip acts as a proxy and downloads the file from the...

Cisco WebEx Meetings Serve Information Disclosure Vulnerability (CNVD-2018-02047)

Cisco WebEx Meetings Server CWMS is the United States Cisco Cisco WebEx meeting program in a set of multifunctional meeting solutions that include audio, video and Web conferencing. An information disclosure vulnerability exists in Cisco WebEx Meetings Server that stems from the program's failure...

CVE-2018-0089

A vulnerability in the Policy and Charging Rules Function PCRF of the Cisco Policy Suite CPS could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access ...

CVE-2018-0111

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw i...

CVE-2018-0089

A vulnerability in the Policy and Charging Rules Function PCRF of the Cisco Policy Suite CPS could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access ...

PT-2018-8618

Name of the Vulnerable Software and Affected Versions: Cisco WebEx Meetings Server affected versions not specified Description: A design flaw in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. This could enable the attack...

Cisco WebEx Meetings Server Information Disclosure Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw i...

Server side request forgery (ssrf)

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

PT-2018-6353

Name of the Vulnerable Software and Affected Versions: Atlassian Jira versions prior to 7.6.1 Description: The issue allows remote attackers to access internal network resources via a Server Side Request Forgery SSRF in the Trello importer. This flaw can be used to access a metadata resource that...

CVE-2017-16865: Server-Side Request Forgery (SSRF)

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...

BEIMS ContractorWeb 5.18.0.0 - SQL Injection

Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0 CVE : 2017-17721 Vulnerability Details:...

LocalTapiola: Verbose error message reveals internal system hostnames, protols and used ports (yrityspalvelu.tapiola.fi)

Issue The reporter found an error page that contained a reference to a server name + port in the internal network. No actual vulnerability or weakness was reported. Fix The error page was changed to a static page. Reasoning Trivial error page injection reports will not be accepted for this domain...

CVE-2017-12342

A vulnerability in the Open Agent Container OAC feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packets outside the scope of the OAC. The vulnerability is due to insufficient internal security measures in the OAC feature. An attacker could...

CVE-2017-12342

A vulnerability in the Open Agent Container OAC feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packets outside the scope of the OAC. The vulnerability is due to insufficient internal security measures in the OAC feature. An attacker could...