Informatica: accounts.informatica.com - RCE due to exposed Groovy console

Researcher identified a misconfigured "Groovy" panel on an AEM web application that was vulnerable to RCE. The panel was subsequently disabled...

Let Experts Do Their Job – Managed WAF by Indusface

WAF Web Application Firewall has been the first line of defence when it comes to application security for a while now. Many organizations have adopted WAF in one form or the other and most cases, compliance has been the driver for adoption. But unfortunately, when it comes to the efficacy of WAF ...

osTicket 1.12 - Persistent Cross-Site Scripting via File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: osTicket-v1.12 Stored XSS via File Upload Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiy...

Apache Ranger Cross-Site Request Forgery Vulnerability

Apache Ranger is a set of architectures from the Apache USA Software Foundation that implement comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

Crunchbase Cognitoys Dino Cross-Site Scripting Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site scripting vulnerability exists in Crunchbase Cognitoys Dino. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

osTicket 1.12 - Persistent Cross-Site Scripting via File Upload

Exploit Title: osTicket-v1.12 Stored XSS via File Upload Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps CVE: CVE-2019-14748 1. Descriptio...

NETGEAR EX7000 Cross-Site Scripting Vulnerability

The NETGEAR EX7000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR EX7000 version V1.0.0.421.0.94. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execute...

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection

Exploit Title: Joomla! component comjsjobs - SQL Injection Dork: inurl:"index.php?option=comjsjobs" Date: 11.08.19 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.5 Tested on: Debian/nginx/joomla 3.9.0 Vulnerabili...

osTicket 1.12 - Persistent Cross-Site Scripting

osTicket 1.12 - Persistent Cross-Site Scripting Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps...

Crunchbase Cognitoys Dino Cross-Site Request Forgery Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site request forgery vulnerability exists in the Crunchbase Cognitoys Dino device. The vulnerability stems from the WEB application not adequately verifying that a request is from a trusted...

Bagisto Cross-Site Request Forgery Vulnerability

Bagisto is a set of open source e-commerce framework. A cross-site request forgery vulnerability exists in Bagisto version 0.1.5, which stems from a WEB application that does not adequately validate whether a request comes from a trusted user, and can be exploited by an attacker to send an...

cPanel cross-site scripting vulnerability (CNVD-2019-28987)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the listftpstable AP in versions prior to cPanel 60.0.25. The vulnerabili...

TeamPass <= 2.1.27.36 Multiple XSS Vulnerabilities

TeamPass is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-1954 Cisco Webex Meetings Server Open Redirection Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Daily Expense Manager 1.0 - Cross-Site Request Forgery Delete Income Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager...

SQL Injection Vulnerability in ASK2 Q&A System Ap***.php File

ASK2 Q&A is an open source PHP Q&A program. ASK2 Q&A System Ap.php file has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Open-School Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School version 3.0 and Community Edition version 2.3...

TeamPass Cross-Site Scripting Vulnerability (CNVD-2020-16615)

TeamPass is an open source password manager. A cross-site scripting vulnerability exists in TeamPass version 2.1.27.35, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

College Notes Management System 1.0 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: email protected Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/...