99 matches found
CISA Releases Five Industrial Control Systems Advisories
CISA released five Industrial Control Systems ICS advisories on August 3, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-215-01 Mitsubishi Electric GOT2000 and GOT SIMPLE ICSA-23-215-02 Mitsubishi Electric GT...
CVE-2023-0956: Improper Limitation of a Pathname to a Restricted Directory
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system...
CVE-2023-34096
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write...
Path traversal
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write...
CVE-2023-34096 Thruk has Path Traversal Vulnerability in panorama.pm
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write...
CVE-2018-25073: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2....
CVE-2021-44076
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...
CVE-2021-44076
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...
CVE-2021-44076: Improper Neutralization of Input During Web Page Generation
An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting XSS. The payload can be executed in multiple scenarios, for example when the user'...
OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
Exploit Title: OctoBot WebInterface 0.4.3 - Remote Code Execution RCE Date: 9/2/2021 Exploit Author: Samy Younsi, Thomas Knudsen Vendor Homepage: https://www.octobot.online/ Software Link: https://github.com/Drakkar-Software/OctoBot Version: 0.4.0beta3 - 0.4.3 Tested on: Linux Ubuntu, CentOs CVE ...
OctoBot WebInterface 0.4.3 - Remote Code Execution Exploit
Exploit Title: OctoBot WebInterface 0.4.3 - Remote Code Execution RCE Exploit Author: Samy Younsi, Thomas Knudsen Vendor Homepage: https://www.octobot.online/ Software Link: https://github.com/Drakkar-Software/OctoBot Version: 0.4.0beta3 - 0.4.3 Tested on: Linux Ubuntu, CentOs CVE : CVE-2021-3671...
GHSA-FR75-X856-Q6J8 Octobot mishandles Tentacles upload
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
Octobot mishandles Tentacles upload
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
CVE-2021-36711
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
CVE-2021-36711
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
PYSEC-2022-235
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
Remote code execution
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
CVE-2021-36711
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
CVE-2021-36711: Unrestricted Upload of File with Dangerous Type
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled...
PT-2022-10536
Name of the Vulnerable Software and Affected Versions OctoBot versions prior to 0.4.4 Description The issue allows remote code execution due to mishandling of Tentacles upload in the WebInterface. Recommendations For versions prior to 0.4.4, update to version 0.4.4 or later to resolve the issue...