Webswing Remote Code Execution Vulnerability

Webswing is a web server that lets you run any swing application in a web browser using only pure HTML5. A remote code execution vulnerability exists in JsLink in Webswing that can be exploited by an attacker to execute code in the server...

Remote code execution

u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client through webserver due to lack of array bound check.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon...

The vulnerability of the microprogramming software of the programmable logic controller SIMATIC S7-1200 allows a intruder to execute malicious JavaScript code.

The vulnerability of the microprogrammed control system for the SIMATIC S7-1200 programmable logic controller is related to the lack of security measures taken for the web server. Exploiting this vulnerability allows a malicious actor to execute malicious JavaScript code remotely...

CVE-2019-16064

Summary: CVE-2019-16064 affects NETSAS Enigma NMS 65.0.0 and earlier. A directory traversal vulnerability allows an authenticated user to access files and directories outside the web root, enabling listing of OS directory contents, creating directories, uploading files, and modifying/deleting fil...

Unauthorized access vulnerability in geoserver

GeoServer is a J2EE implementation of the OpenGIS Web Server specification. GeoServer makes it easy to publish map data, allows users to update, delete and insert feature data, and makes it easy to share spatial geographic information between users. There is an unauthorized access vulnerability i...

Bullwark Momentum Series JAWS 1.0 - Directory Traversal

Bullwark Momentum Series JAWS 1.0 - Directory Traversal Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal Date: 2019-12-11 Author: Numan Türle Vendor Homepage: http://www.bullwark.net/ Version : Bullwark Momentum Series Web Server JAWS/1.0 Software Link :...

Dirstalk - Modern Alternative To Dirbuster/Dirb

Dirstalk is a multi threaded application designed to brute force paths on web servers. The tool contains functionalities similar to the ones offered by dirbuster and dirb. Here you can see it in action: How to use it The application is self-documenting, launching dirstalk -h will return all the...

CVE-2019-10267

CVE-2019-10267 affects Ahsay Cloud Backup Suite 8.1.0.50 . The vulnerability is an insecure file upload that allows placing a file in any server directory; an attacker can upload a JSP shell to the web root and execute it, resulting in full access to the system under the configured user (e.g., Ad...

CVE-2019-1010200

CVE-2019-1010200 affects Voice Builder components (two web servers exposing /tts and /alignment endpoints). Root cause: OS Command Injection due to improper neutralization of special elements in user-supplied input. Impact: remote code execution with the same privileges as the server. Attack vect...

CVE-2019-10933

CVE-2019-10933 affects Siemens Spectrum Power corporate UI components across Spectrum Power 3 (<= v3.11), Power 4 (v4.75), Power 5 (< v5.50), and Power 7 (

Arbitrary Code Injection

The Apache HTTP Server is a popular web server. Cross-site scripting XSS flaws were found in the modproxybalancer module's manager web interface. If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitra...

CVE-2019-10243

CVE-2019-10243 affects Eclipse Kura up to v4.0.0. The issue is that Kura exposes the underlying Ui Web server version in its replies, which an attacker could use as a hint to craft targeted attacks against the Kura web server. The provided documents do not specify a fixed version or remediation; ...

Microsoft Azure DevOps Server CVE-2019-0869 HTML Injection Vulnerability

Description Microsoft Azure DevOps Server is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, to conduct spoofing attacks or redirect the user to a malicious website. Other attacks are al...

openSUSE Security Update : otrs (openSUSE-2019-973)

This update for otrs fixes the following issues : Update to version 4.0.33. Security issues fixed : - CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of OTRS. -...

PHP 7.0.x < 7.0.23 Heap-based Buffer Overflow Vulnerability

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.23. It is, therefore, affected by a heap-based buffer overflow condition exists in the ext/standard/varunserializer.re script due to improper use of the hash API for key deletion. An unauthenticated...

CVE-2018-16555

A vulnerability has been identified in SCALANCE S602 All versions V4.0.1.1, SCALANCE S612 All versions V4.0.1.1, SCALANCE S623 All versions V4.0.1.1, SCALANCE S627-2M All versions V4.0.1.1. The integrated web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked in...

Machine Learning Penetration Testing: GyoiThon

GyoiThon is a growing penetration test tool using Deep Learning. Deep Learning improves classification accuracy in proportion to the amount of learning data. Therefore, GyoiThon will be taking in new learning data during every scan. Since GyoiThon uses various features of software included in HTT...

Web Shell Detector - PHP Script That Helps You Find And Identify PHP / CGI (Perl) / ASP / ASPX Shells

Web Shell Detector is a php script that helps you find and identify php/cgiperl/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%. By using the latest javascript and css technologies, web shell detector has a light weight and...

CVE-2017-1000235

CVE-2017-1000235 affects Librarian versions 4.6 and earlier (including 4.7) with an OS command injection vulnerability in batchimport.php, allowing an attacker to fully compromise the web server. Root cause is command injection via batchimport.php; impact is complete compromise of confidentiality...

International Islamic University Chittagong: Directory Listing

https://ieeeiiucsb.org/assets/reg/assets/ It was observed that the above URLs are vulnerable to Directory Traversal Attack. Properly controlling access to web content is crucial for running a secure web server. Directory Traversal is an HTTP exploit which allows attackers to access restricted...