webroot.com XSS vulnerability

Vulnerable URL: https://www.webroot.com/us/en/about/press-room/releases/webroot-acquires-securecast?" Details: Description| Value ---|--- Patched:| Yes, at 10.10.2017 Latest check for patch:| 10.10.2017 07:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 33464...

Unitrends UEB 9.1 - Privilege Escalation

Exploit Title: Authenticated lowpriv RCE for Unitrends UEB 9.1 Date: 08/08/2017 Exploit Authors: Benny Husted, Jared Arave, Cale Smith Contact: https://twitter.com/iotennui || https://twitter.com/BennyHusted || https://twitter.com/0xC413 Vendor Homepage: https://www.unitrends.com/ Software Link:...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Node.js Security Scanner: Web Exploit Detector

Node.js Security Scanner: Web Exploit Detector The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites...

Webroot 'mistakenly' flags Windows as Malware and Facebook as Phishing site

Popular antivirus service Webroot mistakenly flagged core Windows system files as malicious and even started temporarily removing some of the legit files, trashing user computers around the world. The havoc caused after the company released a bad update on April 24, which was pulled after...

Homebrew: [bot.brew.sh] Full Path Disclosure

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

MyBB smilie Module < 1.8.11 - 'pathfolder' Directory Traversal

Description: ============ product: MyBB Homepage: https://mybb.com/ vulnerable version: input'pathfolder'; Line 327 $dir = @opendirMYBBROOT.$path; if we input "pathfolder" to "../../bypass/smile",Directory Traversal success! ============ Fixed: ============ This vulnerability was fixed in version...

DzSoft PHP Editor 4.2.7 - File Enumeration

DzSoft PHP Editor 4.2.7 - File Enumeration + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/DZSOFT-v4.2.7-PHP-EDITOR-FILE-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.dzsoft.com Product:...

Code injection

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot...

CVE-2014-8731: Deserialization of Untrusted Data

PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serialized data and the last part of the concatenated filename," which creates a file in webroot...

UBUNTU-CVE-2016-6255

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

CVE-2016-6255

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

CVE-2016-6255

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

CVE-2016-6255

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

CVE-2016-6255

Removed by vendor...

CVE-2016-6255: Improper Access Control

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

Rockstar Games: full path disclosure on www.rockstargames.com via apache filename brute forcing

In this report, the researcher found that sending a request with an invalid Accept header to http://www.rockstargames.com/index resulted in a full path disclosure to the webroot. This was fixed as a result of the researcher's aid. Please be aware that after this report was resolved, we added "Pat...

CVE-2017-5219

An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to the application to enhance provided functionality. This functionality allows a zip file to be uploaded, containing a valid .ecf component...

Roundcube 1.2.2: Command Execution via Email

中文分析：http://paper.seebug.org/138/ Author: p0wd3r, LG 知道创宇404安全实验室 Roundcube is a widely distributed open-source webmail software used by many organizations and companies around the globe. The mirror on SourceForge, for example, counts more than 260,000 downloads in the last 12 months1 which is on...

PT-2017-8945

Name of the Vulnerable Software and Affected Versions Portable UPnP SDK aka libupnp versions prior to 1.6.21 Description The issue allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler. This can be achieved by sending a POST request to ...