12873 matches found
PT-2019-13304 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.840 Description: The issue allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log, potentially exposing file and directory information. Recommendations: For...
PT-2019-13306 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: The issue allows attackers to steal a cookie or session, or redirect to a phishing website through Reflected XSS in the filemanager2.php file, specifically targeting the fm current dir parameter...
OECMS Cross-Site Request Forgery Vulnerability
OECMS is an enterprise web content management system CMS. A cross-site request forgery vulnerability exists in the admincp.php file in OECMS. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this...
Uber: Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information
The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that...
Sql injection
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
Magento Administration Panel Login Form Detected
Magento Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...
How Will Companies Deploy Industrial IoT Security Solutions?
Industrial IoT IIoT devices will comprise the majority of the billions of IoT devices deployed over the next decade. How will the information security market meet this onslaught of technology? The consumer market is not a useful guide for this analysis. Consumers buy in small quantities and choos...
CentOS Web Panel Information Disclosure Vulnerability
CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.846. An attacker can exploit the vulnerability by reading the HTTP response to check for a valid username...
CentOS Web Panel Authorization Issues Vulnerability
CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.836. During login, a remote attacker can exploit this vulnerability to bypass authentication with the help of a valid username...
CentOS Web Panel Authentication Bypass Vulnerability
CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP versions 0.9.8.838 through 0.9.8.846. During login, a remote attacker can exploit this vulnerability to bypass authentication with the help of a valid username...
Cross-Site Scripting
Overview Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.8.0...
Cross-Site Scripting
Overview Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31...
U.S. Dept Of Defense: [██████████] Unauthorized access to admin panel
In previous reports, I described vulnerabilities in a panel to which I had access. 512269 512693 512695 I could log in to this site and then perform some attacks, such as SQL injection\XSS or other bugs. But before the above vulnerabilities were considered by you, the possibility to bypass...
CentOS Control Web Panel 0.9.8.838 - User Enumeration Vulnerability
Exploit for linux platform in category web applications Exploit Title: CWP CentOS Control Web Panel 0.9.8.848 User Enumeration via HTTP Response Message Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/changelog Softwa...
CentOS Control Web Panel 0.9.8.836 - Authentication Bypass Vulnerability
Exploit for linux platform in category web applications Exploit Title: CWP CentOS Control Web Panel ||/us...
CentOS Control Web Panel Elevation of Privilege Vulnerability
CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability exists in CWP version 0.9.8.836. An attacker can exploit the vulnerability by uploading specially crafted session files to the /tmp directory with the help of the cwpsrv-xxx cookie, which can then be used to gain...
CentOS Control Web Panel 0.9.8.836 - Privilege Escalation Vulnerability
Exploit for linux platform in category web applications //====================================================================\ || || || CWP Control Web Panel 0.9.8.836 - 0.9.8.839 || || Root Privilege Escalation || || || \====================================================================//...
CVE-2019-13359
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user...
CVE-2019-13359
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user...