Recently-Patched Adobe ColdFusion Flaw Exploited By APT

An Adobe ColdFusion vulnerability, patched two months ago, was being exploited in the wild by a China-linked APT group, researchers found. The vulnerability, CVE-2018-15961, is a critical unrestricted file upload bug that could also lead to arbitrary code-execution, researchers at Volexity, who...

DocCms 2016 version has a file upload vulnerability at the backend templates

DocCMS rice husk enterprise building system, also known as rice husk cms, doccms, formerly known as deep throat enterprise building system ShlCms, is the industry's leading free open source enterprise website building system, enterprise website generation system. DocCms 2016 version of the file...

Arbitrary File Upload Vulnerability in the Frontend of Online Training System of Beijing Xinqi Technology Co.

Beijing Xinqi Technology Co., Ltd. is a technical service enterprise specializing in the research and development of training management software. An arbitrary file upload vulnerability exists in the frontend of the online training system of Beijing Xinqi Technology Co. The vulnerability allows a...

Webshell Bypass Vulnerability in Web Security Dog (IIS Edition) V4.0

Website Security Dog IIS Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features for comprehensive website security. Webshell bypass vulnerability exists in Web Security Dog IIS Edition V4.0. An attacker can...

File Upload Vulnerability in JEECMS v9.3

JEECMS is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with the payment and financial settlement of the content of the e-commerce as one of the conte...

File Upload Vulnerability in DESTOON B2B Website Management System

DESTOON B2B website management system is an open source B2B e-commerce industry portal solution based on PHP+MySQL. Currently, it has models of launchers, substations, malls, supply, requisition, quotation, companies, exhibitions, articles, information, PinPong, group purchasing, galleries,...

DedeCMS File Write Vulnerability

DedeCMS is a PHP-based web content management system CMS. A file write vulnerability exists in files in DedeCMS version 5.7 SP2, which can be exploited by an attacker to create a script file and obtain a webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Design/Logic Flaw

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

The connected sources confirm a concrete vulnerability in DedeCMS v5.7 SP2 (PHP-based CMS): a file-write flaw that attackers can exploit to write a script file and obtain a webshell. This CVE (CVE-2018-16785) is described as affecting DedeCMS 5.7 SP2 with XML injection/file-write mechanics enabli...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Click It Up: Targeting Local Government Payment Portals

FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...

File Upload Vulnerability in Chengdu Silo Technology Co.

Chengdu Silo Technology Co., Ltd. provides WEB-based system development, services covering web design, website program development, mainstream domain name registration, domestic and international space application, WEB system development, secondary development of WeChat, cell phone website...

File Upload Vulnerability in Laoban CMS Backend

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. File upload vulnerability exists in the background of Laoban CMS. It allows attackers to upload webshell and gain server privileges...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-19563)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A security vulnerability exists in the 'doexport' function in the app/system/feedback/admin/feedbackadmin.class.php file in MetInfo version 6.1.0. The vulnerability can be exploited ...

File Upload Vulnerability in YCCMS v3.3

YCCMS is a PHP version of a lightweight CMS builder. A file upload vulnerability exists in YCCMS v3.3. It allows attackers to upload webshell and gain server privileges...

Apache Portals Pluto 3.0.0 Remote Code Execution

Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested on: Windows Advisory:...

Apache Portals Pluto 3.0.0 - Remote Code Execution

Apache Portals Pluto 3.0.0 - Remote Code Execution Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested...

Apache Portals Pluto 3.0.0 - Remote Code Execution

Exploit Title: Apache Portals Pluto 3.0.0 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://portals.apache.org/pluto/ Software Link: http://archive.apache.org/dist/portals/pluto/ Version: 3.0.0 Tested on: Windows Advisory:...