CVE-2017-17830

Bus Booking Script has CSRF via admin/newmaster.php...

Unauthorized Access

salt is vulnerable to unauthorized access through its minions. The vulnerability exists as the Vault minions are receiving master tokens, which can be used to access secrets, even without a matching access policy...

DEBIAN-CVE-2014-3250

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4...

EMC ScaleIO for Linux Information Disclosure Vulnerability

EMC ScaleIO for Linux is a software-defined solution for converting DAS storage to shared data block storage based on the Linux platform from EMC. An information disclosure vulnerability exists in EMC ScaleIO version 2.0.1.x for Linux-based platforms, which originates when the program saves the...

master-belt.com XSS vulnerability

Open Bug Bounty ID: OBB-401713 Description| Value ---|--- Affected Website:| master-belt.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

IBM InfoSphere Master Data Management Security Bypass Vulnerability (CNVD-2017-35510)

IBM InfoSphere Master Data Management MDM - Collaborative Edition is a suite of collaborative editing solutions for Product Information Management PIM from IBM USA. A security vulnerability exists in IBM InfoSphere MDM - Collaborative Edition. An attacker could exploit the vulnerability to downlo...

SaltStack Salt Directory Traversal Vulnerability (CNVD-2017-35509)

SaltStack Salt aka SaltStack is a set of open source tools for managing infrastructure from SaltStack, Inc. in the United States. The tool provides configuration management, remote execution and other functions , able to manage tens of thousands of servers , with the ability to quickly complete t...

CVE-2017-1523

IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authentication. IBM X-Force ID: 129892...

Puppet vulnerable to Path Traversal

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...

GHSA-G89M-3WJW-H857 Puppet vulnerable to Path Traversal

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...

UBUNTU-CVE-2017-14695

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an...

PYSEC-2017-36

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an...

photoshop-master.ru XSS vulnerability

Open Bug Bounty ID: OBB-363661 Description| Value ---|--- Affected Website:| photoshop-master.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Puppet `resource_type` Remote Code Execution Vulnerability

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resourcetype service. NOTE: this vulnerability can only be exploited...

Arbitrary file delete/D.O.S on Puppet Master

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...

Redis-store Design Vulnerability

Redis-store is a Ruby-based application-specific toolkit that supports sharding, master-slave replication, and grouping. A security vulnerability exists in Redis-store 1.3.0 and earlier versions. An attacker can exploit the vulnerability to load insecure objects from redis...

CVE-2017-10398

Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications subcomponent: BaseMasterPage. The supported version that is affected is 9.0.2.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Orac...

Tor: Enforce minimum master password complexity

Hi Team, Actual results: There is no password complexity set for Master password in about:preferencessecurity , Because I was able to set my password like 123,123456,www, admin etc which is really common, apart from that we can use spaces as well in master password i was able to set space as my...

AMC Master Arbitrary File Upload

Exploit Title: Annual Maintenance Contract Management System - Arbitrary File Upload Dork: N/A Date: 26.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/amc-master-annual-maintenance-contract-management-system/20667703 Demo:...

AMC Master - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Annual Maintenance Contract Management System - Arbitrary File Upload Dork: N/A Date: 26.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link:...