Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting

Exploit Title: Stored XSS Date: 25-04-2019 Exploit Author: Dhiraj Mishra Vendor Homepage: https://portals.apache.org/pluto Software Link: https://portals.apache.org/pluto/download.html Version: 3.0.0, 3.0.1 Tested on: Ubuntu 16.04 LTS CVE: CVE-2019-0186 References:...

Apache Pluto 3.0.0 3.0.1 - Persistent Cross-Site Scripting

Apache Pluto 3.0.0 3.0.1 - Persistent Cross-Site Scripting Exploit Title: Stored XSS Date: 25-04-2019 Exploit Author: Dhiraj Mishra Vendor Homepage: https://portals.apache.org/pluto Software Link: https://portals.apache.org/pluto/download.html Version: 3.0.0, 3.0.1 Tested on: Ubuntu 16.04 LTS CVE...

CVE-2019-2702

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2019-2702

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

Buffer overflow

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2019-2702

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2019-2702

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2019-2702

CVE-2019-2702 affects Oracle Hospitality Cruise Dining Room Management (Web Service subcomponent) in Oracle Hospitality Applications, with affected version 8.0.80. The vulnerability allows unauthenticated, network-accessed HTTP access to compromise the Cruise Dining Room Management component. Imp...

PT-2019-16440

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Cruise Dining Room Management version 8.0.80 Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Dining Room Management, potentially impacting...

CVE-2019-2702: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Cruise Dining Room Management component of Oracle Hospitality Applications subcomponent: Web Service. The supported version that is affected is 8.0.80. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

Oracle Hospitality Applications Hospitality Cruise Dining Room Management Component Input Validation Error Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hotel management from Oracle. The product provides human resources cost management, provide customer service throughout the journey tracking management to improve customer satisfaction and other...

April 2, 2019, update for Office 2016 (KB4462239)

None None...

Hacking Virtual Reality – Researchers Exploit Popular Bigscreen VR App

A team of cybersecurity researchers from the University of New Haven yesterday released a video demonstrating how vulnerabilities that most programmers often underestimate could have allowed hackers to evade privacy and security of your virtual reality experience as well as the real world...

Server side request forgery (ssrf)

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message...

GitLab: Inadequate cache control in gitter allows to view private chat room

Hi Gitlab, Summary: I have found a inadequate cache control vulnerability in Gitter. Description: You can use the backspace button to get the full access to the account. There is no cache control and the browser saves sensitive information of a private chat room. This report is influenced by the...

CVE-2019-7632

CVE-2019-7632 affects LifeSize Team, Room, Passport, and Networker 220 devices. The issue is an authenticated remote OS command injection via shell metacharacters in the support/mtusize.php mtu_size parameter, with potential authentication via the default cli password noted in some cases. This yi...

PT-2019-18676

Name of the Vulnerable Software and Affected Versions LifeSize Team, Room, Passport, and Networker 220 devices affected versions not specified Description The issue allows authenticated remote OS command injection. This can be demonstrated by using shell metacharacters in the mtu size parameter o...

CVE-2019-7632: Improper Neutralization of Special Elements used in an OS Command

LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the support/mtusize.php mtusize parameter. The lifesize default password for the cli account may sometimes be used for authentication...

Hotel Booking Script 3.4 - CSRF (Change Admin Password) Vulnerability

Exploit for php platform in category web applications Exploit Title: Admin Account take over Via CSRF Exploit Author: Sainadh Jamalpur Vendor Homepage: https://www.phpjabbers.com/hotel-booking-system/ Software Link:...

Hotel Booking Script 3.4 - Cross-Site Request Forgery (Change Admin Password)

Hotel Booking Script 3.4 - Cross-Site Request Forgery Change Admin Password Exploit Title: Admin Account take over Via CSRF Google Dork: N/A Date: 17-12-2018 Exploit Author: Sainadh Jamalpur Vendor Homepage: https://www.phpjabbers.com/hotel-booking-system/ Software Link:...