Information disclosure

An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI, as demonstrated by intranet URLs for reports...

CVE-2018-7209

An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idashboards/config.xml URI, as demonstrated by intranet URLs for reports...

intranet.cb.amrita.edu XSS vulnerability

Open Bug Bounty ID: OBB-522544 Description| Value ---|--- Affected Website:| intranet.cb.amrita.edu Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

intranet.uow.edu.au XSS vulnerability

Open Bug Bounty ID: OBB-486908 Description| Value ---|--- Affected Website:| intranet.uow.edu.au Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

GitLab: SSRF vulnerability in gitlab.com webhook

1、 Login to your GitLab account and create a new project, then go to--https://gitlab.com/username/project/settings/integrations 2、 You can add url to ssrf.following are the steps to reproduce: If you enter http://127.0.0.1:80/haha.txt as url,we will get --Hook executed successfully but returned...

intranet.reutlingen-university.de XSS vulnerability

Open Bug Bounty ID: OBB-455879 Description| Value ---|--- Affected Website:| intranet.reutlingen-university.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

intranet.skhsjs.edu.hk XSS vulnerability

Open Bug Bounty ID: OBB-449990 Description| Value ---|--- Affected Website:| intranet.skhsjs.edu.hk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

SSRF vulnerability in APPCMS admin\download_frame.php file

APPCMS is a professional APP content management system that provides a variety of extension modules, such as information, recommended positions, topics, friendly links, body internal links and so on, to help webmasters better personalize their own websites. An SSRF vulnerability exists in the...

thoughtbot Paperclip ruby gem server-side request forgery vulnerability

The thoughtbot Paperclip ruby gem is an open source Ruby-based file attachment manager from thoughtbot, USA. A server-side request forgery vulnerability exists in the Paperclip::UriAdapter class in the thoughtbot Paperclip ruby gem 3.1.4 and later versions. An attacker can exploit this...

File Containment Vulnerability in Youkai 365 Business v1.5 System

Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. A file inclusion vulnerability exists in the UX365 Business v1.5 system, which is due...

Server side request forgery (ssrf)

SSRF exists in Webmin 1.850 via the PATHINFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000...

CVE-2017-15644

SSRF exists in Webmin 1.850 via the PATHINFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000...

CVE-2017-15280

The CVE-2017-15280 entry applies to Umbraco CMS and describes an XML External Entity (XXE) vulnerability affecting earlier Umbraco versions (notably before 7.7.3). The underlying issue is XXE in the XML parsing path related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.as...

Umbraco CMS XML External Entity Vulnerability

Umbraco is the leading open source Microsoft ASP.NET CMS. An XML external entity vulnerability exists in Umbraco CMS, which could allow an attacker to obtain sensitive information by reading files on the server or sending TCP requests to an intranet host...

intranet.eddocs.com XSS vulnerability

Vulnerable URL: https://intranet.eddocs.com/authenticate/default.php?msg=%22%3E%3Csvg/onload=prompt%27openbugbounty%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

Multiple Vulnerabilities in LaneCat Intranet Security Management System Vulnerabilities

LaneCat is a carrier-grade Internet behavior management system launched by Xiamen Chengchuang Technology Co. LaneCat intranet security management system has denial of service and SQL injection vulnerabilities, attackers can send unlimited verification codes to cell phones to consume server...

Docutek Solutions Good for Enterprise for Android Privilege Gain Vulnerability

Docutek Solutions Good for Enterprise for Android is a mobile coworking application from Docutek Solutions for the Android platform. The program supports features such as email, calendar and contacts. A security vulnerability exists in version 3.0.0.415 of the Docutek Solutions Good for Enterpris...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...