Umbraco CMS XML External Entity Vulnerability

Umbraco is the leading open source Microsoft ASP.NET CMS. An XML external entity vulnerability exists in Umbraco CMS, which could allow an attacker to obtain sensitive information by reading files on the server or sending TCP requests to an intranet host...

intranet.eddocs.com XSS vulnerability

Vulnerable URL: https://intranet.eddocs.com/authenticate/default.php?msg=%22%3E%3Csvg/onload=prompt%27openbugbounty%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

CVE-2017-14797: Inadequate Encryption Strength

Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys and consequently bypass the pushlink protection mechanism, and obtain complete control of the connected accessories by leveraging the ability to sniff HTTP traffic on...

Multiple Vulnerabilities in LaneCat Intranet Security Management System Vulnerabilities

LaneCat is a carrier-grade Internet behavior management system launched by Xiamen Chengchuang Technology Co. LaneCat intranet security management system has denial of service and SQL injection vulnerabilities, attackers can send unlimited verification codes to cell phones to consume server...

PT-2017-13690

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge BSB002 version 1707040932 Description The issue is related to a lack of transport encryption in the public API, allowing remote attackers to read API keys by sniffing HTTP traffic on the local intranet network. This can lead...

Docutek Solutions Good for Enterprise for Android Privilege Gain Vulnerability

Docutek Solutions Good for Enterprise for Android is a mobile coworking application from Docutek Solutions for the Android platform. The program supports features such as email, calendar and contacts. A security vulnerability exists in version 3.0.0.415 of the Docutek Solutions Good for Enterpris...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

CVE-2015-9232

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

PT-2017-7560

Name of the Vulnerable Software and Affected Versions Good for Enterprise application version 3.0.0.415 Description The issue concerns the lack of signature protection for the Authentication Delegation API intent in the Good for Enterprise application. Additionally, the Good Dynamic application...

CVE-2015-9232: Insufficient Verification of Data Authenticity

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Server Side Request Forgery (SSRF)

Wordpress is vulnerable to local server side request forgery SSRF attacks. The attacks are possible because the application ignores octal and hexadecimal IP address formats for intranet address, allowing attackers to escape the SSRF protection mechanism through malicious IP addresses...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

CVE-2017-11148

Synology Chat contains a Server-Side Request Forgery (SSRF) in the link preview component that affects versions prior to 1.1.0-0806. Remote authenticated users can access intranet resources via unspecified vectors. The CNVD/NVD entries confirm the vulnerability in Synology Chat and warn about the...

CVE-2017-11148: Server-Side Request Forgery (SSRF)

Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...

SSRF Vulnerability in Wordpress updraftplus Plugin

Wordpress updraftplus is a plugin that assists Wordpress users in backing up their websites, allowing them to back up their entire site to various clouds. An SSRF vulnerability exists in the Wordpress updraftplus plugin. The vulnerability is due to admin.php script updraftajaxhandler function uri...

PT-2017-11773

Name of the Vulnerable Software and Affected Versions Synology Chat versions prior to 1.1.0-0806 Description A server-side request forgery SSRF issue exists in the link preview feature of Synology Chat, allowing remote authenticated users to access intranet resources. Recommendations For versions...