WordPress Caldera Forms 1.7.4 Database Disclosure

Exploit Title : WordPress Caldera Forms Plugins 1.7.4 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org/plugins/caldera-forms/ calderaforms.com/updates/caldera-forms-1-7-4/ Software Download Link ...

WordPress wp-contactpage-designer 1.0 Database Disclosure

Exploit Title : WordPress wp-contactpage-designer Plugins 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 03/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Versio...

Joomla Com_Finder 4.0.0 Database Disclosure

Exploit Title : Joomla ComFinder Components 4.0.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : joomla.org Software Download Links :...

WordPress TemplateOne 1.0 Database Disclosure

Exploit Title : WordPress TemplateOne Themes 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : wordpress.org dubicars.com Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Versio...

WordPress jomiz-plugins-accounting 1.0 Database Disclosure

Exploit Title : WordPress jomiz-plugins-accounting Plugins 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Software Download Link : N/A Category : WebApps Explo...

WordPress paid-memberships-pro 1.5.2 Database Disclosure

Exploit Title : WordPress paid-memberships-pro Plugins 1.5.2 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : paidmembershipspro.com/update-1-5-2/ wordpress.org/plugins/pmpro-bbpress/ Software Download Link :...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3836-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3836-2 advisory. USN-3836-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

USN-3836-1: Linux kernel vulnerabilities

Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. CVE-2018-18955 Philipp Wendler discovered that the overlayfs implementati...

USN-3836-1 linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities

Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. CVE-2018-18955 Philipp Wendler discovered that the overlayfs implementati...

HTTP Request Smuggling

Node.js is vulnerable to HTTP request smuggling. Improper parsing of the path option of an HTTP request allows for a remote attacker to smuggle an HTTP request using Unicode data within the HTTP request, potentially bypassing existing access controls...

Hostname Spoofing

Node.js is vulnerable to hostname spoofing. The hostname can be spoofed using a mixed case Javascript e.g. javAscript protocol if the node.js application uses url.parse to determine the hostname of the URL. This causes hostname-based access controls to be incorrect and allows a remote attacker to...

Joomla Event Booking 3.8.3 Database Disclosure

Exploit Title : Joomla comeventbooking 3.8.3 Components Database Backup Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 29/11/2018 Vendor Homepage : extensions.joomla.org/extension/event-booking/ +...

WordPress Events Calendar Premium 1.0 Database Disclosure

Exploit Title : WordPress events-calendar-premium Plugins 1.0 Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 30/11/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Category : WebApps Version...

WordPress hwm_board 1.0 Arbitrary File Disclosure

Exploit Title : WordPress hwmboard 1.0 Plugins Korea Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 28/11/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Category : WebApps Version Information : All Current...

Information Disclosure

ShowDoc/ShowDoc is vulnerable to information disclosure. The library does not properly configure it's access controls by default, allowing a malicious user to use the pageid variable in the URL to gain access to sensitive information...

SonarSource SonarQube 7.3 Information Disclosure Vulnerability

Exploit for multiple platform in category web applications Exploit Title: SonarSource SonarQube 7.3 - Information Disclosure Vendor Homepage: https://www.sonarsource.com/ Software Link: https://www.sonarqube.org/downloads/ Version: 7.3 and prior CVE : CVE-2018-19413 Description: A vulnerability i...

Authorization

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13355

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13355

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13355

CVE-2018-13355 affects TerraMaster TOS 3.1.03; a flawed access control in ajaxdata.php allows attackers to create user groups without proper authorization. This undermines integrity and could enable privilege elevation within the system. No remediation or patch details are provided in the connect...