MailEnable Cross-Site Scripting Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A cross-site scripting vulnerability exists in the mail settings in MailEnable versions prior to 8.60. The vulnerability can be exploited by an attacker to read local files or scan the internal network by sending the...

Information Disclosure

openstack-heat is vulnerable to information disclosure. An information-leak vulnerability was found in the OpenStack Orchestration heat service. Launching a new stack with a local URL resulted in a detailed error message, allowing an authenticated user to conduct network discovery and reveal the...

CVE-2019-6257

A Server Side Request Forgery SSRF vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents in php/elFinder.class.php...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents in php/elFinder.class.php...

CVE-2019-6257: Server-Side Request Forgery (SSRF)

A Server Side Request Forgery SSRF vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in getremotecontents in php/elFinder.class.php...

Citrix Receiver keeps prompting for authentication when accessed remotely

Getting prompted by the Citrix Receiver client to authenticate and to enter user name and password. It does not happen when the laptop is connected to the internal network. Only happens over VPN...

Dell Resets All Customers' Passwords After Potential Security Breach

Multinational computer technology company Dell disclosed Wednesday that its online electronics marketplace experienced a "cybersecurity incident" earlier this month when an unknown group of hackers infiltrated its internal network. On November 9, Dell detected and disrupted unauthorized activity ...

CVE-2018-19244

An XML External Entity XXE vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked...

Nextcloud: Server-Side request forgery in New-Subscription feature of the calendar app

CVSS ---- 8.5 High CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Description ----------- The "New Subscription" functionality of the official Calendar app allows authenticated users to direct the server to perform arbitrary external requests, and then displays the full response to the user. The...

XML external entity expansion in org.apache.solr:solr-core

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion XXE in Solr config files currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file. In addition, Xinclude functionality provided in these config files is als...

GHSA-G8J6-M4P7-5RFQ High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

Launching Process of Published Apps and Desktops for the Internal Network Through Citrix Storefront

This is the internal Network Flow of a Published Apps/Desktop Session through Citrix Storefront bypassing Citrix Netscaler Gateway for troubleshooting purposes...

Asset Inventory for Internal Network: problems with Active Scanning and advantages of Splunk

In the previous post, I was writing about Asset Inventory and Vulnerability Scanning on the Network Perimeter. Now it's time to write about the Internal Network. I see a typical IT-infrastructure of a large organization as monstrous favela, like Kowloon Walled City in Hong Kong. At the beginning ...

CVE-2018-13790

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

CVE-2018-13790: Server-Side Request Forgery (SSRF)

A Server Side Request Forgery SSRF vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page...

CVE-2018-13108

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of the ISP e.g., VoIP credentials or attack th...

Design/Logic Flaw

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of the ISP e.g., VoIP credentials or attack th...

CVE-2018-13108

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of the ISP e.g., VoIP credentials or attack th...