Microsoft Windows: Disallow Autoplay for non-volume devices

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windisallowautoplaynonvolumedevices.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Disallow Autoplay for non-volume devices Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

WebSocket Live Chat - Cross-Site Scripting

WebSocket Live Chat - Cross-Site Scripting Exploit Title: WebSocket Live Chat - Cross-Site Scripting Date: 2018-05-22 Exploit Author: Alireza Norkazemi Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?srank=1 POC : 1 Create your account and click...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-10489)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in the Site Title field of the Base Settings on the Site Settings in Z-BlogPHP version 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary w...

NodAPS 4.0 - SQL injection Cross-Site Request Forgery

NodAPS 4.0 - SQL injection Cross-Site Request Forgery Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage:...

POSCMS 'index' function arbitrary code execution vulnerability

POSCMS PhpOpenSourceCMS is a PHP and MySQL based, open source, cross-platform web content management system CMS. A security vulnerability exists in POSCMS version 3.2.10. An attacker can exploit the vulnerability by writing code to the api/ucsso/config.php file with the help of the 'index' functi...

PT-2018-4024

Name of the Vulnerable Software and Affected Versions Dell Inspiron systems' Absolute Computrace Agent affected versions not specified Description The issue is related to a race condition between the Absolute Computrace Agent and the Dell Client Configuration Utility DCCU. This condition allows...

Moodle 3.x Bypass Vulnerability (Jan 2018) - Linux

Setting for blocked hosts list can be bypassed with multiple A record hostnames. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Windows 10: Accounts: Rename administrator account

The Accounts: Rename administrator account policy setting determines whether a different account name is associated with the security identifier SID for the administrator account. Because the administrator account exists on all Windows 10 for desktop editions Home, Pro, Enterprise, and Education,...

Microsoft Windows: Accounts: Administrator account status

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winadministratoraccountstatus.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Accounts: Administrator account status WMI Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

CVE-2018-10680

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings -- Basic setting -- Website title" and enters an XSS payload via the zbsystem/cmd.php ZCBLOGNAME parameter. NOTE: the vendor disputes the security relevance, noting ...

Microsoft Windows 10: Act as part of the operating system

The Act as part of the operating system policy setting determines whether a process can assume the identity of any user and thereby gain access to the resources that the user is authorized to access. OpenVAS Vulnerability Test $Id: win10actaspartofos.nasl 11532 2018-09-21 19:07:30Z cfischer $ Che...

Microsoft Windows 10: Modify firmware environment values

This security setting determines who can modify firmware environment values. Firmware environment values are settings that are stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On all computers, this user right is required to install or...

Microsoft Windows 10: Replace a process level token

This policy setting determines which parent processes can replace the access token that is associated with a child process. Specifically, the Replace a process level token setting determines which user accounts can call the CreateProcessAsUser application programming interface API so that one...

Microsoft Windows 10: Change the time zone

This policy setting determines which users can adjust the time zone that is used by the device for displaying the local time, which includes the device OpenVAS Vulnerability Test $Id: win10changetimezone.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Change the time zone WMI Authors:...

Microsoft Windows 10: Restore files and directories

This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object. OpenVAS Vulnerability Test $Id:...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10430

DiliCMS 2.4.0 has a Stored XSS vulnerability in the admin/index.php, specifically in the fourth textbox of System setting → site setting. The issue is described across multiple connected sources as a stored XSS; no exploit details are provided in the documents. The root cause and impact are limit...

CVE-2018-10430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

PT-2018-9882

Name of the Vulnerable Software and Affected Versions: DiliCMS version 2.4.0 Description: A Stored XSS issue was found in the fourth textbox of "System setting-site setting" in admin/index.php, allowing for potential exploitation. Recommendations: For DiliCMS version 2.4.0, consider restricting...