Nagios XI Cross-Site Scripting Vulnerability (CNVD-2018-23143)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in Nagios XI 5.5.6. A remote, unauthenticated attacker can exploit this vulnerability via...

LAOBANCMS Administrator Password Reset Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has an administrator password reset vulnerability. Attackers can use this vulnerability to reset the administrator password even if...

PHPCMS Code Injection Vulnerability

PHPCMS is a website content management system based on PHP and Mysql architecture, which includes modules such as news, pictures, downloads, information and products. A code injection vulnerability exists in PHPCMS 2008, which can be exploited to write arbitrary content to the website cache and...

LAOBANCMS cross-site scripting vulnerability (CNVD-2018-23076)

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 suffers from a cross-site scripting vulnerability. Attackers can use the vulnerability through the admin/liuyan.php neirong paramete...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

Hiroshi Yuki YukiWiki Cross-Site Scripting Vulnerability

Hiroshi Yuki YukiWiki is a Wiki engine. A cross-site scripting vulnerability exists in Hiroshi Yuki YukiWiki 2.1.3 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary script in a user's web browser...

Fastspot Bigtree Session Fixation Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A session fixation vulnerability exists in Fastspot Bigtree that stems from the fact that after a user logs into the application, the admin.php file receives the PHP session ID...

CVE-2018-18579

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...

CVE-2018-18433

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

Acunetix Web Vulnerability Scanner 10 *.slg Buffer Overflow (PoC) Exploit

Exploit for windows platform in category dos / poc Exploit Title: Acunetix Web Vulnerability Scanner 10 ".slg" Buffer Overflow PoC Author: Kağan Çapar Software Link: https://s3.amazonaws.com/a280ccaaf904330a389db759e6275285/acunetixtrial.exe Vendor Homepage : https://www.acunetix.com Tested...

CVE-2018-15539

Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc...

U.S. Dept Of Defense: Unencrypted __VIEWSTATE parameter in a DoD website

Hi there i realise that the information passing to the server in the subdomain http://████████ can be seen without any encryption thought the VIEWSTATE Parameter. To reduce the change of someone interception the information the parameter should be encrypted due to the sensivity of the information...

Junos OS: Denial of Service in J-Web

A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenticate or to perform J-Web operations. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series;...

CVE-2018-2470

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-20549)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

YUNUCMS cross-site scripting vulnerability (CNVD-2018-20067)

YUNUCMS is China Yunyou YUNU network technology company of a set of open source enterprise station building content management system CMS. YUNUCMS 1.1.4 version of the index.php/index/category/index page there is a cross-site scripting vulnerability, a remote attacker can take advantage of the...

Navigate CMS 2.8 Cross Site Scripting

Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the...

SeaCMS cross-site scripting vulnerability (CNVD-2018-20093)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the admindatarelate.php file in SeaCMS version 6.64. A remote attacker can exploit this...

Navigate CMS 2.8 - Cross-Site Scripting

Navigate CMS 2.8 - Cross-Site Scripting Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...

Adobe ColdFusion Arbitrary File Upload Vulnerability

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file upload vulnerability exists in Adobe ColdFusion. An attacker can exploit the vulnerability to upload arbitrary...