5796 matches found
CVE-2019-10664
Domoticz exposure CVE-2019-10664 affects versions before 4.10578, where an SQL Injection is possible via the idx parameter in CWebServer::GetFloorplanImage (WebServer.cpp). Root cause is unsafeguarded SQL handling in the web server component. Reported impact includes potential escalation of acces...
PT-2019-11977
Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 4.10578 Description The issue allows SQL Injection via the idx parameter in the CWebServer::GetFloorplanImage function in WebServer.cpp. Recommendations For versions prior to 4.10578, update to version 4.10578 or lat...
DASAN H660RM Information Disclosure / Hardcoded Key Vulnerability
DASAN H660RM allows for unauthenticated ping access, has a hardcoded key for encryption, and logs sensitive information into /tmp. DASAN H660RM Information Disclosure / Hardcoded Key CVE-2019-9974: diagtool.cgi on DASAN H660RM devices with firmware 1.03-0022 allows spawning ping processes without...
DASAN H660RM Information Disclosure / Hardcoded Key
Hi! CVE-2019-9974: diagtool.cgi on DASAN H660RM devices with firmware 1.03-0022 allows spawning ping processes without any authorization leading to information disclosure and DoS attacks Remote attacker could enumerate hosts on LAN interface sending requests to /cgi-bin/diagtool.cgi with ip...
Immunity Canvas: JENKINS_CHECKSCRIPT_RCE
Name| jenkinscheckscriptrce ---|--- CVE| CVE-2019-1003029 Exploit Pack| CANVAS Description| RCE on Jenkins checkScript Notes| CVE Name: CVE-2019-1003029 CVE-2019-1003005 CVE-2018-1000861 VENDOR: Jenkins NOTES: Groovy Plugin supports sandboxed Groovy expressions for its 'System Groovy'...
Design/Logic Flaw
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver...
CVE-2013-2565
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver...
CVE-2013-2565
CVE-2013-2565 concerns Mambo CMS v4.6.5. Connected documents confirm the vulnerability resides in scripts thumbs.php, editorFrame.php, editor.php, images.php, and manager.php, which disclose the webserver’s root path. The available sources do not provide exploitation details, affected versions be...
CVE-2013-2565
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver...
TinyMCE JBimages 3.x JustBoilMe Arbitrary File Upload
Exploit Title : TinyMCE JBimages Plugin 3.x JustBoilMe Arbitrary File Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : justboil.marketto.ru tiny.cloud Software Download Link :...
H2O H2O WebServer Heap Buffer Overflow (CVE-2018-0608)
A heap buffer overflow vulnerability has been reported in H2O web server. The Vulnerability is due to insufficient input validation when writing to the access log. A remote, unauthenticated attacker can trigger this vulnerability by sending a crafted message to the target server. Successful...
Path Traversal in cordova-plugin-ionic-webview
Versions of cordova-plugin-ionic-webview prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of the app...
Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow
''' ======================================================== Unauthenticated Stack Overflow in Multiple Gpon Devices ======================================================== . contents:: Table Of Content Overview ======== Title:- StackOverflow in Multiple Skyworth GPON HomeGateways and Optical...
Node.js third-party modules: [takeapeek] XSS via HTML tag injection in directory lisiting page
I was taking a peek at takeapeek module and found it is vulnerable to XSS via malicious injection in directory listing. It allows execution of arbitrary JS code. Module module name: takeapeek version: 0.2.2 npm page: https://www.npmjs.com/package/takeapeek Module Description A simple static...
Debian: Security Advisory (DLA-1647-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
sricam-gsoap2.8-dos-exploit
sricam-gsoap2.8-dos-exploit Sricam gSOAP2.8 DoS exploit proo...
Code injection
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object...
PYSEC-2019-147
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object...
