Cisco Enterprise Chat and Email Attachment Download Vulnerability

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco. The product focuses on providing e-mail, chat, and Web callback capabilities, among other things, for other Cisco solutions. An attachment download vulnerability exists in the HTTP API for Cisco...

File Upload Vulnerability in Waychar 120 Emergency Command Center Web Services System

120 Emergency Command Center Web Service System is a set of web application services for 120 Emergency Command Center, including internal training, learning and assessment functions. A file upload vulnerability exists in the waychar 120 Emergency Command Center Web Service System. The vulnerabili...

Denial of Service Vulnerability in Schneider Electric M340 PLCs

M340 is a medium-sized PLC from Schneider Electric, which is widely used in the industrial control field in China. A denial of service vulnerability exists in the Schneider Electric M340 PLC. An attacker can cause a web service denial of response by constructing a special message to be sent on po...

PT-2019-11600

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.7 Moodle versions prior to 3.6.4 Description: A flaw was found in a web service that fetches messages, which was not restricted to the current user's conversations. Recommendations: For versions prior to 3.7, update...

PT-2019-2666

Name of the Vulnerable Software and Affected Versions Siveillance VMS versions prior to V11.2a Siveillance VMS versions prior to V12.1a Siveillance VMS versions prior to V12.2a Siveillance VMS versions prior to V12.3a Siveillance VMS versions prior to V13.1a Description The issue is related to...

Heap overflow

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383: Out-of-bounds Write

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle...

Oracle CTI Web Service - (EBS_ASSET_HISTORY_OPERATIONS) XML Entity Injection Exploit

Exploit for java platform in category web applications Exploit Title: Oracle CTI Web Service XML Entity Exp. Exploit Author: omurugur Author Web: https://www.justsecnow.com Author Social: @omurugurrr URL : http://10.248.68.188/EBSASSETHISTORYOPERATIONS As can be seen in the following request /...

Oracle CTI Web Service - EBS_ASSET_HISTORY_OPERATIONS XML Entity Injection

Oracle CTI Web Service - EBSASSETHISTORYOPERATIONS XML Entity Injection Exploit Title: Oracle CTI Web Service XML Entity Exp. Exploit Author: omurugur Author Web: https://www.justsecnow.com Author Social: @omurugurrr URL : http://server/EBSASSETHISTORYOPERATIONS As can be seen in the following...

Oracle CTI Web Service - 'EBS_ASSET_HISTORY_OPERATIONS' XML Entity Injection

Exploit Title: Oracle CTI Web Service XML Entity Exp. Exploit Author: omurugur Author Web: https://www.justsecnow.com Author Social: @omurugurrr URL : http://server/EBSASSETHISTORYOPERATIONS As can be seen in the following request / response example, the xml entity expansion attack can be...

CVE-2018-6885

An issue was discovered in MicroStrategy Web Services the Microsoft Office plugin before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticated and leads to access to the asset files with the MicroStrategy user privileges. This includes the credentials to access the admin dashboard...

PT-2019-11033

Name of the Vulnerable Software and Affected Versions: MicroStrategy Web Services versions prior to 10.4 Hotfix 7 MicroStrategy Web Services versions prior to 10.11 Description: The issue allows unauthenticated access to asset files with MicroStrategy user privileges, potentially leading to acces...

CVE-2019-5430

In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page...

CVE-2019-11593

In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect...

Open redirect

In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect...

CVE-2019-11594

In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect...

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

MAAS Cross-Site Scripting Vulnerability

Canonical Ubuntu Metal as a Service MAAS is a suite of cloud server deployment and management tools from Canonical in the UK. The tool enables centralized deployment and management of a large number of server hardware environments. A cross-site scripting vulnerability exists in the REST API in...