9840 matches found
SOL99998454 - iControl REST vulnerability CVE-2016-5021
Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...
Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution', 'Description' = %q This module exploits a remo...
REST JSON - Multiple Vulnerabilities - Highly Critical - Unsupported - SA-CONTRIB-2016-033
This module enables you to expose content, users and comments via a JSON API. The module contains multiple vulnerabilities including Node access bypass Comment access bypass User enumeration Field access bypass User registration bypass Blocked user login Session name guessing Session enumeration...
CVE-2016-3087
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin...
CVE-2016-3087
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin...
PT-2016-5363
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.28 Description The issue allows remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin when Dynamic Method Invocation is enabled...
Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
This module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 except 2.3.20.2 and 2.3.24.2. Remote Code Execution can be performed when using REST Plugin with ! operator when Dynamic Method Invocation is enabled. This module requires Metasploit:...
Struts2 remote code execution vulnerability S2-0 3 3 technology analysis and protection solution-vulnerability warning-the black bar safety net
Apache Struts2 in open dynamic method invocation Dynamic Method Invocation case, the attacker using the REST plug-in calls a malicious expression can be remote code execution. This vulnerability number CVE-2 0 1 6-3 0 8 7, named S2-0 3 of 3. This article on the vulnerability of technical analysis...
Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-03754 )
Apache Struts is an open source framework for creating enterprise Java Web applications. A remote code execution vulnerability exists in Struts2, which can be exploited by an attacker to remotely execute code using a REST plugin to invoke a malicious expression with dynamic methods enabled...
CVE-2016-3087
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! exclamation mark operator to the REST Plugin...
XenAPI For XenForo 1.4.1 SQL Injection
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE...
XenAPI 1.4.1 for XenForo - Multiple SQL Injections
Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...
Magento < 2.0.6 - Unauthenticated Remote Code Execution
参考来源：http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/ The vulnerability CVE-2016-4010 allows an attacker to execute PHP code at the vulnerable Magento server unauthenticated. This vulnerability actually consists of many small vulnerabilities Magento is an extremely...
RHEL 6 / 7 : ruby193-rubygem-katello (RHSA-2016:1083)
An update for ruby193-rubygem-katello is now available for Red Hat Satellite 6.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2016-3072
An input sanitization flaw was found in the scoped search parameters sortby and sortorder in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database...
Apache Struts 2.x < 2.3.28.1 Multiple Vulnerabilities
The version of Apache Struts running on the remote host is 2.x prior to 2.3.28.1. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists, related to chained expressions, when Dynamic Method Invocation DMI is enabled. An unauthenticated, remote attacker can...
Whitewidow - SQL Vulnerability Scanner
Whitewidow is an open source automated SQL vulnerability scanner, that is capable of running through a file list, or can scrape Google for potential vulnerable websites. It allows automatic file formatting, random user agents, IP addresses, server information, multiple SQL injection syntax, and a...
Automated SQL Vulnerability Scanner: Whitewidow
Open Source Automated SQL Vulnerability Scanner Whitewidow is an open source automated SQL vulnerability scanner, that is capable of running through a file list, or can scrape Google for potential vulnerable websites. It allows automatic file formatting, random user agents, IP addresses, server...
