Error message discloses existence of file in write-only share (NC-SA-2017-003)

Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages...

Alstrasoft Video Share Enterprise 4.72 - SQL Injection

Alstrasoft Video Share Enterprise 4.72 - SQL Injection Exploit Title: AlstraSoft Video Share Enterprise v4.72 Script - SQL Injection Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/videoshare.htm Demo:...

Alstrasoft Video Share Enterprise 4.72 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: AlstraSoft Video Share Enterprise v4.72 Script - SQL Injection Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/videoshare.htm Demo:...

Alstrasoft Video Share Enterprise 4.72 - SQL Injection

Exploit Title: AlstraSoft Video Share Enterprise v4.72 Script - SQL Injection Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/videoshare.htm Demo: http://www.alstrahost.com/vs/ Version: 4.72 Tested on: Win7 x64, Kali Linux x64...

Information disclosure in email field dialog at sharing - ownCloud

An attacker can get sensitive information in the E-Mail share dialog with the autocompletion by default Affected Software ownCloud Server 9.1.3 CVE-2017-5866 core/c27b2b935f940a2c8e2fc1a5d8934407ae85dd57 ownCloud Server 9.0.7 CVE-2017-5866 core/62b1865a301a1ce90f9a3c773f5eb00c33deb581 ownCloud...

Ghostscript 9.20 - Filename Command Execution

Ghostscript 9.20 - Filename Command Execution + + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/GHOSTSCRIPT-FILENAME-COMMAND-EXECUTION.txt + ISR: ApparitionSec + Vendor: =============== ghostscript.com Product:...

Design/Logic Flaw

Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tcapi.dll that is located in the same folder on a remote file share as a pcap file that is being processed...

GLSA-201701-56 : zlib: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201701-56 zlib: Multiple vulnerabilities Multiple vulnerabilities have been discovered in zlib. Please review the CVE identifiers referenced below for details. Impact : An attacker could cause a Denial of Service condition...

VK.com: SSRF через Share-ботов

Отсутствие флуд-контроля на Share-ботах...

WordPress plugin wp-sns-share suffers from a reflected cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin wp-sns-share 'index.php' page, which can be exploited by attackers to construct...

Bypass received read-only share permissions using read-write reshare - ownCloud

User can upload and modify the link share contents even though the original sharer has only read-only access. Affected Software ownCloud Server 9.1.2 CVE-2016-???? core/c7c1b61e10514fe4d8efbaf1156501dd795e7ac1 ownCloud Server 9.0.6 CVE-2016-???? core/65af3785ab5e1d780598874b3553c93767447f1f Actio...

Server: Bypass received read-only share permissions using read-write reshare

User can upload and modify the link share contents even though the original sharer has only read-only access. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Microsoft Windows Media Center 6.1.7600 - ehshell.exe XML External Entity Injection

Microsoft Windows Media Center 6.1.7600 - ehshell.exe XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-MEDIA-CENTER-XXE-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor:...

Sagem Fast 3304-V2 Credential Disclosure

Exploit title: FAST3304v2 Credentials Disclosure vulnerability Author: Nassim Asrir Author Company: HenceForth Author Email: [email protected] Discovered on: 13/11/2016 Tested on: Linux x8664 / Mozilla Firefox 49. Tested Version: Sagem Fast 3304-V2 other versions may also be affected Vendor:...

VK.com: SSRF (open) - via GET request

Потенциальный DoS сервиса share через SSRF. Продемонстрирована возможность проведения атаки через приложения ВК. Сервис upload.php / parseshare игнорировал идентифицирующие ключи hash и rhash, а также не производил проверку Content- по целевому url. Большой таймаут серверного запроса позволял...

Moderate: Red Hat Security Advisory: openstack-manila-ui security update

An update for openstack-manila-ui is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 Kilo for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

openstack-manila-ui: persistent XSS in metadata field

A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this...

openstack-manila-ui: persistent XSS in metadata field

A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this...

Moderate: Red Hat Security Advisory: openstack-manila-ui security update

An update for openstack-manila-ui is now available for Red Hat OpenStack Platform 8.0 Liberty. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

openstack-manila-ui: persistent XSS in metadata field

A cross-site scripting flaw was discovered in openstack-manila-ui's Metadata field contained in its "Create Share" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the "Shares" overview. Remote, authenticated, but unprivileged users could exploit this...