Directory Traversal Vulnerability in Cruising Cloud Light Forum System

Cruise Cloud Light Forum System is an open source web application based on JAVA + MYSQL architecture, including forums, Q&A modules. Patrol Cloud Light Forum system has a directory traversal vulnerability that can be exploited by an attacker to view the server file system structure and file conte...

Dell RSA Authentication Manager Cross-Site Request Forgery Vulnerability

Dell RSA Authentication Manager is a centralized suite of binary authentication software from Dell, Inc. The software centralizes the management of binary identities, security tokens, methods and users across physical sites. A cross-site request forgery vulnerability exists in Dell RSA...

Code Execution Vulnerability in WeCenter

WeCenter is a PHP + MYSQL based similar to know the Q&A based open source social network builder. A code execution vulnerability exists in WeCenter, which can be exploited by attackers to execute malicious code...

Dairy Farm Shop Management System Cross-Site Scripting Vulnerability

Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system . A cross-site scripting vulnerability exists in Dairy Farm Shop Management System version 1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker...

Automated Attacks Call for Automated Protection – 2020 Trend #3

In our blog series on security trends, we’ve been diving deeper into the five security predictions for 2020 made by our CTO Kunal Anand during his fireside chat with Imperva CMO David Gee. Watch it here. As I'll discuss in my upcoming blog on defense-in-depth and reducing risk, being “connected”...

Complaint Management System 4.0 - Remote Code Execution

Complaint Management System 4.0 - Remote Code Execution Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category:...

Atlassian JIRA < 7.4.2 XSS vulnerability (JRASERVER-66624)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.4.2. It is therefore, potentially affected by a cross-site scripting XSS vulnerability in the orderby parameter due to improper validation of user-supplied input data. An...

Complaint Management System 4.0 Remote Code Execution

Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows Description: There...

Complaint Management System 4.0 - Remote Code Execution

Exploit Title: Complaint Management System 4.0 - Remote Code Execution Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows Description: There...

CVE-2019-20354

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

CVE-2019-20354

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

Path traversal

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

CVE-2019-20354

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

CVE-2019-20354

CVE-2019-20354 affects piSignage before 2.6.4: the web application’s player API (api/settings/log?file=..) allows authenticated, low-privilege users to perform directory traversal and download arbitrary files from the Raspberry Pi. Root cause is improper validation of the file parameter, enabling...

Dairy Farm Shop Management System 1.0 SQL Injection

Exploit Title: Dairy Farm Shop Management System 1.0 - 'username' SQL Injection Google Dork: N/A Date: 2020-01-03 Exploit Author: Chris Inzinga Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ Version: v1.0 Teste...

Atlassian JIRA < 7.8.1 Cross-Site Scripting (XSS) Vulnerability (JRASERVER-67106)

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to 7.8.1. It is, therefore, potentially affected by a cross-site scripting vulnerability in the name of quick filters. Note that Nessus has not tested for this issue but has inste...

Code Execution Vulnerability in MoMoCMS

MoMoCMS is an enterprise building system developed by php+MySQL. MoMoCMS has a code execution vulnerability that can be exploited by attackers to execute arbitrary code...

Hardcoded credentials

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to...

CVE-2013-4752

The CVE-2013-4752 issue affects Symfony’s HttpFoundation component across Symfony 2.0.x up to 2.0.24, 2.1.x up to 2.1.12, 2.2.x up to 2.2.5, and 2.3.x up to 2.3.3. The vulnerability arises because the Host header can be manipulated when the framework generates an absolute URL, enabling a remote a...

CVE-2019-14863

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...