elFinder PHP Connector exiftran Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'elFinder PHP Connector exiftran Command Injection', 'Description' = %q This module exploits a command injection vulnerability in elFinder version...

Abandoned Cart Lite for WooCommerce < 5.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

The savedata AJAX call, used by unauthenticated users, such as guest during the checkout process, does not sanitise or validate user input for example billingfirstname, billinglastname, and billingcompany fields. This leads to a Stored Cross-Site Scripting issue which will be triggered in the adm...

CVE-2018-18815

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability tha...

Authorization

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability tha...

CVE-2018-18815

CVE-2018-18815 affects the REST API component of TIBCO JasperReports Server and related editions, enabling unauthenticated bypass of authorization for portions of the HTTP interface. Affected releases include JasperReports Server 6.4.0–6.4.3 and 7.1.0, Community Edition up to 7.1.0, ActiveMatrix ...

CVE-2018-18815 TIBCO JasperReports Server User Information Disclosure

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability tha...

CVE-2019-6565

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script...

CVE-2019-3599 McAfee Agent update fixes an Information Disclosure vulnerability

Information Disclosure vulnerability in Remote logging which is disabled by default in McAfee Agent MA 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled...

CVE-2019-3598

CVE-2019-3598 affects McAfee Agent (MA) 5.x where a bug in how UDP requests are processed leads to a denial of service when handling specially crafted UDP packets. The vulnerability allows remote, unauthenticated attackers to potentially cause the MA service to stop responding, reducing availabil...

Feng Office 3.7.0.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Feng Office 3.7.0.5 - Unauthenticated Remote Command...

elFinder Command Injection v<2.1.48

elFinder is an open-source file manager available as a web application. A command injection vulnerability in the image handling functionality exists for versions prior to 2.1.48. This exploit requires that the exiftran utility be installed. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC...

CVE-2019-3604 ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities

Cross-Site Request Forgery CSRF vulnerability in McAfee ePO legacy Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in McAfee ePO legacy Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors...

Unauthorized Access To Storage Volumes

libglusterfs.so is vulnerable to unauthorized access to storage volumes. The vulnerability exists due to the fix introduced for CVE-2018-1112, allowing unauthenticated users to mount the storage volumes...

Apache CouchDB < 2.3.0 Remote Privilege Escalation Vulnerability - Linux

CouchDB is prone to a remote privilege escalation vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

Design/Logic Flaw

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

CVE-2018-17188

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full...

Local File Inclusion (LFI)

rendertron is vulnerable to local file inclusion LFI attacks. The vulnerability exists due to the ability to include file:/// via alternative protocols which allows unauthenticated users to read local files...