15186 matches found
rating.t30p.ru Open Redirect vulnerability
Open Bug Bounty ID: OBB-455899 Description| Value ---|--- Affected Website:| rating.t30p.ru Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...
GOWPT - Go Web Application Penetration Test
GOWPT is the younger brother of wfuzz a swiss army knife of WAPT, it allow pentester to perform huge activity with no stress at all, just configure it and it's just a matter of clicks. How to install To install gowpt just type: make sudo make install Usage From the -h menu Usage of gowpt: -H valu...
CVE-2017-11562
A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via loginif.php...
CVE-2017-15524
The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...
Security feature bypass
The Application Firewall Pack AFP, aka Web Application Firewall component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request...
Session fixation
A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via loginif.php...
Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update
An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CloudForms: lack of RBAC on various methods in web UI
CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...
CVE-2017-11562
MT4 Networks SenhaSegura Web Application 2.2.23.8 has a session fixation vulnerability exploitable via the login_if.php file. The CNVD entry describes a flaw that could allow an attacker to gain privileges with the help of login_if.php. The CVE entry itself notes a Session Fixation Vulnerability ...
CVE-2017-11562
A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via loginif.php...
CVE-2017-15524
The CVE-2017-15524 entry concerns Kemp Load Balancer’s Application Firewall Pack (AFP/WAF). A security feature bypass exists where HTTP POST data is not inspected, enabling bypass of the Web Application Firewall. Affected versions are Kemp AFP prior to 7.2.40.1; remediation is upgrading to 7.2.40...
Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload Remote Code Execution
Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload Remote Code Execution Exploit Title: Monstra CMS - 3.0.4 RCE Vendor Homepage: http://monstra.org/ Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip Discovered by: Ishaq Mohammed Contact:...
Kemp Load Balancers Security Bypass Vulnerability
Kemp Load Balancer is a load balancing appliance from Kemp Technlogies, Inc.Application Firewall Pack AFP, a.k.a. Web Application Firewall is a Web application firewall component used in... A security bypass vulnerability exists in the AFP component of Kemp Load Balancer versions prior to 7.2.40....
Joomla! Component JB Visa 1.0 - 'visatype' SQL Injection
Exploit Title: Joomla! Component JB Visa 1.0 - SQL Injection Dork: N/A Date: 17.12.2017 Vendor Homepage: http://joombooking.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jb-visa/ Version: 1.0 Category: Webapps Tested on:...
vBulletin <= 5.3.4 Arbitrary File Deletion And RCE Vulnerabilities
vBulletin is prone to arbitrary file deletion and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...
Joomla! Component Guru Pro - 'promocode' SQL Injection
Exploit Title: Joomla! Component Guru Pro 'promocode'- SQL Injection Dork: N/A Date: 17.12.2017 Vendor Homepage: https://www.ijoomla.com/ Software Link: https://www.ijoomla.com/component/digistore/products/47-joomla-add-ons/119-guru-pro/189?Itemid=189 Version: N/A Category: Webapps Tested on:...
CVE-2017-3185
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...
Information disclosure
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...
CVE-2017-3185
ACTi ACTI D/B/I/E series cameras with firmware A1D-500-V6.11.31-AC expose user credentials and account names via GET requests in the web interface, allowing information disclosure through browser history, logs, and refs. Concrete affected components: web application GET handling that processes se...