BOA Web Server 0.94.14rc21 - Arbitrary File Access

BOA Web Server 0.94.14 - Access to arbitrary files as privileges Title: Vulnerability in BOA Webserver 0.94.14 Date: 20-06-2017 Status: Vendor contacted, patch available Scope: Arbitrary file access Platforms: Unix Author: Miguel Mendez Z Vendor Homepage: http://www.boa.org Version: Boa Webserver...

nantahalalibrary.org XSS vulnerability

Vulnerable URL: http://www.nantahalalibrary.org/TLCScripts/interpac.dll?SearchForm=1=pac=,0,%3C!%27/!%22/!%27/%22/--!%3E%3CInput/Autofocus%20/;%20Onfocus=alert'OPENBUGBOUNTY'//%3E%3CSvg%3E= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:|...

AppCheck may insecurely invoke an executable file

Overview AppCheck provided by JIRANSOFT JAPAN, INC. is an anti-ransomware software. AppCheck and its installer contains an issue with the search path for executable files, which may lead to insecurely invoke an executable file CWE-427. Takashi Yoshikawa of Mitsui Bussan Secure Directions, Inc...

beyondbronzeltd.co.uk XSS vulnerability

Vulnerable URL: http://www.beyondbronzeltd.co.uk/wp-content/plugins/wp-password/login.php/"'--! Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 17268443 VIP website status:| No Chec...

PT-2017-18760 · Autotrace +1 · Autotrace +1

Name of the Vulnerable Software and Affected Versions: AutoTrace version 0.31.1 Description: The issue allows remote attackers to cause a denial of service, resulting in an invalid write and SEGV. This is related to the ReadImage function in input-bmp.c. Recommendations: For AutoTrace version...

PT-2017-18755 · Autotrace +1 · Autotrace +1

Name of the Vulnerable Software and Affected Versions: AutoTrace version 0.31.1 Description: The issue is related to a heap-based buffer overflow in the ReadImage function, located in the input-bmp.c file. This overflow occurs at line 497, column 29, and is associated with the libautotrace.a...

PT-2017-6703 · Qdpm · Qdpm

Name of the Vulnerable Software and Affected Versions: qdPM version 8.3 Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to various pages in qdPM, including myAccount, projects, tasks, tickets, discussions, reports, and...

PT-2017-1640 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access control in Windows kernel drivers, which can be exploited by an attacker to elevate their privileges using a specially crafted application. This...

cottam.lancs.sch.uk XSS vulnerability

Vulnerable URL:...

v-83-246-40-128.eu.hostway-enterprise.net. XSS vulnerability

Vulnerable URL:...

SKYSEA Client View vulnerable to arbitrary code execution

Overview SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on t...

geoportale.regione.liguria.it XSS vulnerability

Vulnerable URL: http://geoportale.regione.liguria.it/geoportal/catalog/search/resource/review.page?uuid=%22-alert/OPENBUGBOUNTY/-%22 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

Apache ActiveMQ 5.11.1 / 5.13.2 Directory Traversal / Command Execution

I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw in the fileserver upload/download functionality. I have only been able to reproduce this on Windows, i.e. where "" is a path delimiter. An attacker could use this flaw to upload...

Downloads Resources over HTTP

Overview Affected versions of prebuild-lwip insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on...

Microsoft Windows - LSASS SMB NTLM Exchange Null-Pointer Dereference (MS16-137)

Microsoft Windows - LSASS SMB NTLM Exchange Null-Pointer Dereference MS16-137 MS16-137: LSASS Remote Memory Corruption Advisory Title: LSASS SMB NTLM Exchange Remote Memory Corruption Version: 1.0 Issue type: Null Pointer Dereference Authentication: Pre-Authenticated Affected vendor: Microsoft...

PT-2016-5018 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite 5 affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the list...

ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities

ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities Systems Affected Product : ManageEngine Password Manager Pro Company : ZOHO Corp. Build Number : 8.1 to 8.3 and probably earlier versions Affected Versions : 8102 to 8302 and probably earlier versions Product Description...

madclient.uimserv.net Open Redirect vulnerability

Vulnerable URL: http://madclient.uimserv.net/cl/lid=6252346019218587835/sid=2573743/kid=276287/bid=620503/c=26666/keyword=/sr=175/bidp=594372/cp=38522/kidp=266866/lidp=6252346019218260155/sidp=2573718/clickurl=https://www.xssposed.org Details: Description| Value ---|--- Patched:| No Latest check...

loft-design.org XSS vulnerability

Vulnerable URL: http://loft-design.org/flashdetection.swf?flashContentURL=javascript:alert/XSSPOSED/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...

odkrywamyinterior.pl Open Redirect vulnerability

Vulnerable URL: http://www.odkrywamyinterior.pl/wp-content/themes/prostore/go.php?https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 8968129 Google...