WordPress Calls to Action <= 2.2.7 - Stored XSS

The AJAX action ‘inboundformsave’ allows unauthenticated users to update the content of any specific form on the site. In order to exploit this, a form ID must be enumerated using another unauthenticated AJAX action, ‘inboundgetformdata’. Once a form ID has been enumerated, the content of the for...

Oracle Solaris Third-Party Patch Update : neutron (cve_2014_6414_unauthenticated_access)

The remote Solaris system is missing necessary patches to address security updates : - OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors. CVE-2014-6414 %NASLMINLEVEL 70300 C...

ProjectSend - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProjectSend Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerability in ProjectSend revisions 100...

PT-2016-01: Arbitrary File Upload in Advantech WebAccess

The specialists of the Positive Research center have detected an Arbitrary File Upload vulnerability in Advantech WebAccess. It was discovered that Advantech WebAccess before 8.1 allows remote unauthenticated users to create or write to arbitrary files on the server. How to fix Update your softwa...

ActualAnalyzer 'ant' Cookie Command Execution

This module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior. The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie. This module requires Metasploit: https://metasploit.com/download Current source:...

Updated moodle package fixes security vulnerabilities

In Moodle before 2.6.5, without forcing encoding, it was possible that UTF7 characters could be used to force cross-site scripts to AJAX scripts although this is unlikely on modern browsers and on most Moodle pages MSA-14-0035. In Moodle before 2.6.5, an XSS issue through $searchcourse in...

Add global option "Enable group <anyone>"

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-39912. panel As mentioned in JRA-18076 and JRA-23255, the predefined group anyone poses security risks in many cases as it exposes projects t...

HybridAuth install.php PHP Code Execution

This module exploits a PHP code execution vulnerability in HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php' is not removed after installation allowing unauthenticated users to write PHP code to the application configuration file 'config.php'. Note: This exploit will overwrite th...

Sagem Fast 3304-V1 - Denial Of Service Vulnerability

No description provided by source. Title : Sagem F@st 3304-V1 denial of service Vulnerability Vendor Homepage : http://www.sagemcom.com Tested on : Firefox, Google Chrome Tested Router : Sagem F@st 3304-V1 Date : 2014-07-26 Author : Z3ro0ne Contact : [email protected] Facebook Page :...

Sagem Fast 3304-V1 - Denial of Service

Sagem Fast 3304-V1 - Denial of Service Title : Sagem F@st 3304-V1 denial of service Vulnerability Vendor Homepage : http://www.sagemcom.com Tested on : Firefox, Google Chrome Tested Router : Sagem F@st 3304-V1 Date : 2014-07-26 Author : Z3ro0ne Contact : [email protected] Facebook Page :...

Sagem Fast 3304-V1 - Denial Of Service Vulnerability

Exploit for hardware platform in category dos / poc Title : Sagem email protected 3304-V1 denial of service Vulnerability Vendor Homepage : http://www.sagemcom.com Tested on : Firefox, Google Chrome Tested Router : Sagem email protected 3304-V1 Date : 2014-07-26 Author : Z3ro0ne Contact :...

Sagem Fast 3304-V1 - Denial of Service

Title : Sagem F@st 3304-V1 denial of service Vulnerability Vendor Homepage : http://www.sagemcom.com Tested on : Firefox, Google Chrome Tested Router : Sagem F@st 3304-V1 Date : 2014-07-26 Author : Z3ro0ne Contact : [email protected] Facebook Page : https://www.facebook.com/Z3ro0ne...

BitDefender GravityZone 5.1.5.386 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: Bitdefender GravityZone vulnerable version: =5.1.11.432 impact: critical homepage: http://www.bitdefender.com found: 2014-05-22...

Information disclosure in the REST API

Jira reports the 404 not-found earlier than the 401 not-authorized. This discloses the non-existence of a specific issue numbers to unauthorized users. While this isn't a huge leak, this could come in useful with social engineering. Proof of concept: Both of the calls below are unauthenticated, a...

Puppet < 2.7.26 / 3.6.2 and Enterprise 2.8.x < 2.8.7 Multiple Vulnerabilities

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities : - A privilege escalation vulnerability related to input validation and paths exists in the bundled Ruby environment. An attacker could trick a privileged user into...

MS IIS 4.0/5.0 and PWS Extended Unicode Directory Traversal Vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot ../ directory traversal exploitation if extended UNICODE character representations are used in substitution for / and . Unauthenticated users may acces...

MS IIS 4.0/5.0 and PWS Extended Unicode Directory Traversal Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot ../ directory traversal exploitation if extended UNICODE character representations are used in substitution for / and . Unauthenticated users may acces...

Netscape Enterprise Server 3.0/4.0 'Index' Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2285/info Netscape Enterprise Server with Web Publishing enabled will disclose the directory listing of the server to unauthenticated users who submit an INDEX request. INDEX / HTTP/1.0...

IBM Scalable POWERparallel (SP) 2.0 sdrd Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/371/info There is a vulnerability in the System Data Repository SDR subsystem. The SDR subsystem is used in IBM SP multi-machine parallel processing environments typically associated with Super Computing. The SDR is...

Novell Sentinel Log Manager <= 1.2.0.2 - Retention Policy Vulnerability

No description provided by source. Novell Sentinel Log Manager ver. =1.2.0.2 allows unauthenticated users configuring retention policies. Vendor informed: 2012/09/06 Patch Released: 2012/09/21 PoC: !/bin/bash TARGET=$1 PORT=8443 if $ -ne 1 ; then echo Usage: basename $0 target exit 1 fi echo POST...