SpiceWorks 7.5 TFTP - Remote File Overwrite / Upload Vulnerability

Exploit for windows platform in category remote exploits + Credits: John Page AKA HYP3RLINX Vendor: ================== www.spiceworks.com Product: ================= Spiceworks - 7.5 Provides network inventory and monitoring of all the devices on the network by discovering IP-addressable devices. ...

SpiceWorks 7.5 TFTP - Remote File Overwrite / Upload

Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt + ISR: APPARITIONSEC Vendor: ================== www.spiceworks.com Product: ================= Spiceworks - 7.5 Provides...

Spiceworks 7.5 TFTP Improper Access Control File Overwrite / Upload

Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt + ISR: APPARITIONSEC Vendor: ================== www.spiceworks.com Product: ================= Spiceworks - 7.5 Provides...

SpiceWorks 7.5 TFTP - Remote File Overwrite Upload

SpiceWorks 7.5 TFTP - Remote File Overwrite Upload + Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt + ISR: APPARITIONSEC Vendor: ================== www.spiceworks.com...

CVE-2012-6658

Multiple cross-site scripting XSS vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different...

CVE-2012-2956

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to apiv2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different...

Sql injection

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to apiv2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS...

CVE-2012-6658

CVE-2012-6658 affects SpiceWorks 5.3.75941 and describes multiple XSS vulnerabilities that allow an attacker to inject arbitrary web script or HTML via the syslocation, syscontact, or sysName settings in snmpd.conf. The root cause is improper handling of user-supplied values in these configuratio...

CVE-2012-6658

Multiple cross-site scripting XSS vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different...

CVE-2012-2956

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to apiv2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS...

CVE-2012-2956

CVE-2012-2956 affects SpiceWorks 5.3.75941 with a SQL injection in api_v2.json via the id parameter, allowing remote authenticated users to execute arbitrary SQL commands. Root cause: improper input handling enabling SQL control. Impact: potential data disclosure/modification and impact on integr...

CVE-2014-3740

Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...

Cross site scripting

Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...

CVE-2014-3740

Cross-site scripting XSS vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page...

CVE-2014-3740

CVE-2014-3740 is a stored XSS vulnerability in SpiceWorks IT ticketing system prior to version 7.2.00195. The issue allows remote authenticated users to inject arbitrary script or HTML via the Summary field when submitting a ticket, with exploitation potentially affecting admin sessions when view...

spiceworks 5.3.75941 - Stored XSS and post-auth SQL Injection

No description provided by source. Product: SpiceWorks Version: 5.3.75941 Vendor Site: http://www.spiceworks.com/community/ Software Download Link: http://www.spiceworks.com/download/?utmsource=comm-secondary-link&utmmedium=website&utmcampaign=homepage Installer Filename: Spiceworks.exe MD5:...

Spiceworks 6.0.00993 Multiple Script Injection Vulnerabilities

No description provided by source...

SpiceWorks 7.2.00174 - Persistent XSS Vulnerabilities

No description provided by source. Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system Date: 12/05/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://spiceworks.com Software Link: http://download.spiceworks.com/Spiceworks.exe Version: 7.2.00174 Latest...

CVE-2014-3740 - SpiceWorks Cross-site scripting

Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system CVE: CVE-2014-3740 Vendor: SpiceWorks Product: SpiceWorks IT ticketing system Affected versions: any version below 7.2.00195 Fixed version: 7.2.00195 1. About the application: ======================= SpiceWorks is a...