Command Execution Vulnerability in MyuCMS

MyuCMS is a content management system developed using ThinkPHP. A command execution vulnerability exists in MyuCMS, which can be exploited by an attacker to gain control of a web server...

Remote Code Execution Vulnerability in EmpireCMS

EmpireCMS is a content management system CMS. EmpireCMS suffers from a remote code execution vulnerability that can be exploited by an attacker to gain control of the web server...

Code execution vulnerability in the ad***_we***.php file is*** parameter in seacms backend

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adwe.php file is parameter there is a code execution vulnerability, attackers can use the vulnerability to obtain control of the web server...

Code execution vulnerability in dw*** parameter of ad***_we***.php file in seacms backend

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adwe.php file dw parameter there is a code execution vulnerability, attackers can use the vulnerability to obtain control of the web server...

New PHP Flaw Could Let Attackers Hack Sites Running On Nginx Servers

If you're running any PHP based website on NGINX server and have PHP-FPM feature enabled for better performance, then beware of a newly disclosed vulnerability that could allow unauthorized attackers to hack your website server remotely. The vulnerability, tracked as CVE-2019-11043 , affects...

[SECURITY] [DLA 1970-1] php5 security update

Package : php5 Version : 5.6.40+dfsg-0+deb8u7 CVE ID : CVE-2019-11043 Emil Lerner, beched and d90pwn found a buffer underflow in php5-fpm, a Fast Process Manager for the PHP language, which can lead to remote code execution. Instances are vulnerable depending on the web server configuration, in...

CVE-2019-13525

In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network...

Authentication flaw

In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network...

CVE-2019-13525

In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network...

CVE-2019-13525

CVE-2019-13525 affects Honeywell IP-AK2 Access Control Panel (Version 1.04.07 and earlier). The integrated web server allows remote attackers to obtain web configuration data without authentication over the network due to a missing authentication for a critical function. Impact is information dis...

graphite.composer.views.send_email vulnerable to SSRF

Impact sendemail in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and the...

Command Execution Vulnerability in Website Building System of Suzhou Tatian Information Technology Co.

Suzhou Tower Point Information Technology Co., Ltd. is a service-oriented network company engaged in brand official website customization, website construction, network promotion, micro letter opening and other services. Suzhou Tower Point Information Technology Co., Ltd. website building system...

Moxa EDR-810 Command Injection / Information Disclosure

During an engagement for a client, RandoriSec found 2 vulnerabilities on Moxa EDR-810 Series Secure Routers. The first one is a command injection vulnerability found on the CLI allowing an authenticated user to obtain root privileges. And the other one is an improper access control found on the w...

Code Execution Vulnerability in UCMS Backend File Management

UCMS is a simple open source content management system. A code execution vulnerability exists in the UCMS backend file management, which can be exploited by an attacker to gain control of the web server...

File Upload Vulnerability in OneBase

OneBase is an open source, fast and simple, object-oriented application development architecture based on ThinkPHP5. A file upload vulnerability exists in OneBase, which can be exploited by an attacker to gain control of the web server...

Rocket.Chat 2.1.0 - Cross-Site Scripting

Title: Rocket.Chat 2.1.0 - Cross-Site Scripting Author: 3H34N Date: 2019-10-22 Product: Rocket.Chat Vendor: https://rocket.chat/ Vulnerable Versions: Rocket.Chat 2. Open a chat session 3. Send payload with your web server url 4. Token will be written in logs.txt when target seen your message...

Rocket.Chat 2.1.0 - Cross-Site Scripting

Rocket.Chat 2.1.0 - Cross-Site Scripting Title: Rocket.Chat 2.1.0 - Cross-Site Scripting Author: 3H34N Date: 2019-10-22 Product: Rocket.Chat Vendor: https://rocket.chat/ Vulnerable Versions: Rocket.Chat 2. Open a chat session 3. Send payload with your web server url 4. Token will be written in...

Rocket.Chat 2.1.0 - Cross-Site Scripting Vulnerability

Exploit for linux platform in category web applications Title: Rocket.Chat 2.1.0 - Cross-Site Scripting Author: 3H34N Product: Rocket.Chat Vendor: https://rocket.chat/ Vulnerable Versions: Rocket.Chat 2. Open a chat session 3. Send payload with your web server url 4. Token will be written in...

Rocket.Chat 2.1.0 Cross Site Scripting

Title: Rocket.Chat 2.1.0 - Cross-Site Scripting Author: 3H34N Date: 2019-10-22 Product: Rocket.Chat Vendor: https://rocket.chat/ Vulnerable Versions: Rocket.Chat 2. Open a chat session 3. Send payload with your web server url 4. Token will be written in logs.txt when target seen your message...

Moxa EDR-810 - Command Injection / Information Disclosure Vulnerabilities

During an engagement for a client, RandoriSec found 2 vulnerabilities on Moxa EDR-810 Series Secure Routers. The first one is a command injection vulnerability found on the CLI allowing an authenticated user to obtain root privileges. And the other one is an improper access control found on the w...