CVE-2020-10038

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. An attacker with access to the device's web server might be able to execute administrative commands without authentication...

Siemens LOGO! Web Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Web Server Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote code execution. 3. TECHNICAL DETAILS...

Siemens SICAM MMU, SICAM T, and SICAM SGU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SICAM MMU, SICAM T and SICAM SGU Vulnerabilities: Out-of-bounds Read, Missing Authentication for Critical Function, Missing Encryption of Sensitive Data, Use of Password Hash wit...

WTCMS suffers from a file upload vulnerability (CNVD-2020-47243)

WTCMS is a content management system CMS based on Thinkphp. WTCMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of the web server...

Command Execution Vulnerability in the New X1.0 System of Guangzhou Qibo Network Technology Co.

Zibo's new X1.0 system is a website management system based on the latest thinkphp5 framework. Guangzhou Qibo Network Technology Co., Ltd Qibo new X1.0 system has a command execution vulnerability, which can be exploited by an attacker to gain control of the web server...

File Upload Vulnerability in PHPOK of Shenzhen Kunshuo Technology Co., Ltd (CNVD-2020-47296)

PHPOK is a content management system for website construction developed by Shenzhen KunHei Technology Co. A file upload vulnerability exists in PHPOK, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in Cscms File of Guilin Chongsheng Network Technology Co.

Cscms is a multi-functional network information management system developed by Chongsheng Network Technology. Cscms file has a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

File Upload Vulnerability in TpFlow Workflow Engine

TpFlow workflow engine is a PHP-based development of the workflow engine . A file upload vulnerability exists in TpFlow Workflow Engine, which can be exploited by an attacker to gain control of a web server...

Apple CMS suffers from a command execution vulnerability (CNVD-2020-47330)

Apple CMS is a complete and powerful rapid site building system running on PHP+MYSQL environment. Apple CMS suffers from a command execution vulnerability that can be exploited by attackers to gain control of the web server...

Code execution vulnerability in Ocean CMS (CNVD-2020-47328)

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. A code execution vulnerability exists in Ocean CMS, which can be exploited by attackers to gain control of a web server...

MGASA-2020-0286 Updated pdns-recursor packages fix security vulnerability

Updated pdns-recursor package fixes security vulnerability: An issue has been found in PowerDNS Recursor where the ACL applied to the internal web server via webserver-allow-from is not properly enforced, allowing a remote attacker to send HTTP queries to the internal web server, bypassing the...

Fire Web Server 0.1 - Remote Denial of Service Exploit

Exploit Title: Fire Web Server 0.1 - Remote Denial of Service PoC Exploit Author: Saeed reza Zamanian Vendor Homepage: https://sourceforge.net/projects/firewebserver/ Software Link: https://sourceforge.net/projects/firewebserver/files/ Version: Pre-Alpha Tested on: Windows 7 , Windows Vista...

Command Execution Vulnerability in EyouCms of Hainan Zanzan Network Technology Co. Ltd (CNVD-2020-47671)

EyouCms is a free + open source enterprise content management system developed on the core of TP5.0 framework. Hainan Zanzan Network Technology Co., Ltd. EyouCms there is a command execution vulnerability, attackers can use the vulnerability to obtain control of the web server...

Fire Web Server 0.1 Denial Of Service

Exploit Title: Fire Web Server 0.1 - Remote Denial of Service PoC Date: 2020-06-26 Exploit Author: Saeed reza Zamanian Vendor Homepage: https://sourceforge.net/projects/firewebserver/ Software Link: https://sourceforge.net/projects/firewebserver/files/ Version: Pre-Alpha Tested on: Windows 7 ,...

Fire Web Server 0.1 - Remote Denial of Service (PoC)

Exploit Title: Fire Web Server 0.1 - Remote Denial of Service PoC Date: 2020-06-26 Exploit Author: Saeed reza Zamanian Vendor Homepage: https://sourceforge.net/projects/firewebserver/ Software Link: https://sourceforge.net/projects/firewebserver/files/ Version: Pre-Alpha Tested on: Windows 7 ,...

Engel & Völkers Technology GmbH: SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)

Intro An SQL injection has been identified. Through this vulnerability an attacker could execute arbitrary SQL statements compromising the integrity of the database and obtain sensitive information, violating the confidentiality of the data. Given the great impact of the vulnerability and...

Moderate: Red Hat Security Advisory: rh-nginx116-nginx security update

An update for rh-nginx116-nginx is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2020-15432 · Jenkins · Jenkins Zephyr For Jira Test Management Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zephyr for JIRA Test Management Plugin versions 1.5 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specifi...

IIS-Raid - A Native Backdoor Module For Microsoft IIS (Internet Information Services)

IS Raid is a native IIS module that abuses the extendibility of IIS to backdoor the web server and carry out custom actions defined by an attacker. Documentation When installed, IIS-Raid will process every request and method, check if the X-Password header exists and compare it against the...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...