SSDWLAB 6.1 Authentication Bypass

Exploit Title: SSDWLAB 6.1 - Authentication Bypass Date: 2019-10-01 Exploit Author: Luis Buendía exoticpayloads Vendor Homepage: http://www.sbpsoftware.com/ Version: 6.1 Tested on: IIS 7.5 CVE : Pending Description: By injection on the SOAP function in the EditUserPassword function, it is possibl...

Apache Axis SSRF

The vulnerability of the Apache Axis web-service platform lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Apache Axis XSS

The vulnerability of the Apache Axis web service platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

CVE-2019-2894

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Security. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2019-2958

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

TP-Link TL-WR841N Buffer Overflow Vulnerability

The TP-Link TL-WR841N is a wireless router from China P&L TP-Link. A buffer overflow vulnerability exists in the web service listening on TCP port 80 by default in the TP-LINK TL-WR841N. The vulnerability originates when a network system or product performs an operation on memory without properly...

TP-LINK TL-WR841N Web Service http_parser_main Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Hos...

PT-2019-14977

Name of the Vulnerable Software and Affected Versions TP-LINK TL-WR841N affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the web service,...

Modicon control devices REST API DoS

The vulnerability of Modicon microprogrammed control devices is related to a data processing error in the REST API. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

Apache Flink Remote Code Execution Vulnerability

Apache Flink is an open source stream processing framework developed by the Apache Software Foundation. Apache Flink has a remote code execution vulnerability that can be exploited by uploading a malicious Jar package via the RESTful API to execute arbitrary code...

Web Service suffers from sql injection vulnerability

WebService is a cross-programming language, cross-operating system platform remote invocation technology. Web Service has a sql injection vulnerability that can be exploited by an attacker to obtain sensitive database information...

CVE-2019-16948

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network as opposed to what general web traffic would see...

PT-2019-4318

Name of the Vulnerable Software and Affected Versions Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 versions prior to V6.00.320 Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web...

CVE-2018-3214

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Sound. Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

Directory traversal

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

CVE-2019-18187

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

CVE-2019-18187: Improper Limitation of a Pathname to a Restricted Directory

Trend Micro OfficeScan versions 11.0 and XG 12.0 could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution RCE. The remote process...

Remote Code Execution (RCE) Via Partial Denial Of Service (DoS)

OpenJDK is vulnerable to remote code execution RCE. It is possible because it causes an unexpected exception thrown during Font object deserialization, leading to a partial denial of service DoS of Java SE. A client using a Java sandbox or using a Java web service with data supplies to APIs can b...