Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection

Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order&order=SERIALIZED-OBJECT"...

Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection

Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. PoC Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order=SERIALIZED-OBJECT"...

Fedora 26 : sblim-sfcb (2018-4367d984c1)

Fix NULL pointer DoS vulnerability via POST request to /cimom CVE-2018-6644 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Custom Permalinks <= 1.1 - Authenticated SQL Injection

Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete&permalinks=1 PAYLOAD -- "...

The vulnerability of the web interface of the Sonia (/user/bin/sonia) application, a micro-programmed software for Dahua IP cameras, allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the web interface of the Sonia /user/bin/sonia application, a microprogramming-based IP camera from Dahua, arises due to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure operations beyond memory...

userSpice 4.3 - Cross-Site Scripting

Application UserSpice PHP user management Vulnerability userSpice alert"1"&csrf=8b1339546d6af1e7536da0a705302e9c&updatebio= Vulnerable code: id?" class="nounderline"id?...

LogicalDOC Enterprise 7.7.4 - User Enumeration

LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...

CVE-2018-6644

A NULL pointer dereference flaw was found in the way sblim-sfcb handled processing of POST requests to the /cimom URI. A remote attacker could use this flaw to cause a sblim-sfcb child process to crash via a specially crafted HTTP POST request...

CVE-2018-6644

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

CVE-2018-6644

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

Null pointer dereference

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

CVE-2018-6644

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

CVE-2018-6644

CVE-2018-6644 affects SBLIM Small Footprint CIM Broker (SFCB) 1.4.9. A NULL pointer dereference can occur when handling crafted HTTP POST requests to the /cimom URI, causing DoS by crashing a sblim-sfcb child process. Documented risk is a remote, network-exposed issue with potential partial avail...

CVE-2018-6644

SBLIM Small Footprint CIM Broker SFCB 1.4.9 has a null pointer DoS vulnerability via a crafted POST request to the /cimom URI...

U.S. Dept Of Defense: Blind SQL injection on ████████

Summary: I discovered that a post request made to https://████████/elist/viewem6.php is vulnerable to SQL injection and is quite clearly vulnerable as I was able to induce a 2 second hang on the web page. Additionally I was able to discover the mysql version with a true/false condition...

Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution

Exploit Title: Adobe Coldfusion BlazeDS Java Object Deserialization RCE Date: February 6, 2018 Exploit Author: Faisal Tameesh @DreadSystems Company: Depth Security https://depthsecurity.com Version: Adobe Coldfusion 11.0.03.292866 Tested On: Windows 10 Enterprise 10.0.15063 CVE: CVE-2017-3066...

Hotspot Shield Information Disclosure Vulnerability

Hotspot Shield is a suite of VPN software for accessing free and open networks. A security vulnerability exists in Hotspot Shield that stems from the program's failure to adequately filter user input. The vulnerability can be exploited by sending a POST request to the /status.js file with the...

Design/Logic Flaw

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

CVE-2018-6479

An issue was discovered on Netwave IP Camera devices. An unauthenticated attacker can crash a device by sending a POST request with a huge body size to the / URI...

Code injection

Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the...