12012 matches found
Subsonic Media Server Cross-Site Scripting Vulnerability
Subsonic Media Server is a media file hosting platform. A cross-site scripting vulnerability in the podcast subscription form in Subsonic Media Server version 6.1.1 can be exploited by a remote attacker by sending the 'add' parameter to the podcastReceiverAdmin.view file to manipulate a user's...
Cybercriminals Target Kodi Media Player for Malware Distribution
The Kodi media player has emerged as a malware distribution platform for cybercriminals, recently becoming the target for a cryptomining campaign that compromised about 5,000 machines before being thwarted. Those victims are still at risk, researchers warned. Kodi is free and open-source, and can...
Cross site request forgery (csrf)
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...
CVE-2018-9282
An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS vulnerability in the add parameter to podcastReceiverAdmin.view; no administrator access is required. By injecting a JavaScript payload, this flaw could be used to manipulate a...
CVE-2018-17090
An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazyadresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing followed by tags...
Linux/x86 - Add User(r00t/blank) Polymorphic Shellcode (103 bytes)
/ Shellcode Title: Linux/x86 - Add Userr00t/blank Polymorphic Shellcode 103 bytes Date: 2018-09-13 Author: Ray Doyle @doylersec Homepage: https://www.doyler.net Tested on: Linux/x86 gcc -o polyaddusershellcode -z execstack -fno-stack-protector polyaddusershellcode.c / / Disassembly of section...
CVE-2018-17044
In YzmCMS 5.1, stored XSS exists via the admin/systemmanage/userconfigadd.html title parameter...
MediaTek Wireless Utility rt2870 Denial Of Service
Exploit Title: MediaTek Wirless Utility rt2870 - Denial of Service PoC Autor: Lawrence Amer Date: 2018-09-13 Vendor: MediaTek Software url: https://click.pstmrk.it/2ts/d86o2zu8ugzlg.cloudfront.net%2Fmediatek-craft%2Fdrivers%2FRT27702870RT307x.zip/K94pHAI/oTs1/oC6CdN114w Tested on OS: Windows 7...
CVE-2016-9040
An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When...
CVE-2018-16653
rejucms 2.1 has XSS via the ucenter/cmsuseradd.php uname parameter...
rejucms cross-site scripting vulnerability (CNVD-2018-19433)
rejucms is an online video web content management system CMS. A cross-site scripting vulnerability exists in rejucms version 2.1, which stems from the program's failure to enforce strict filtering. The vulnerability can be exploited to inject arbitrary web script or HTML by sending the 'uname'...
PT-2018-5058 · Joyent · Smartos
Name of the Vulnerable Software and Affected Versions: Joyent SmartOS OS version 20161110T013148Z Description: The issue is related to a denial of service in the Hyprlofs file system. It is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32-bit model. An...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...
FTPShell Server 6.80 - Add Account Name Buffer Overflow (SEH) Exploit
Exploit Title: FTPShell Server 6.80 - 'Add Account Name' Buffer Overflow SEH Discovery by: Luis Martinez Vendor Homepage: http://www.ftpshell.com/ Software Link: http://www.ftpshell.com/downloadserver.htm Tested Version: 6.80 Vulnerability Type: Buffer Overflow SEH Local Tested on OS: Windows XP...
FTPShell Server 6.80 - 'Add Account Name' Buffer Overflow (SEH)
FTPShell Server 6.80 - 'Add Account Name' Buffer Overflow SEH. Remote exploit for Windowsx86 platform. Tags: Local, Buffer Overflow Exploit Title: FTPShell Server 6.80 - 'Add Account Name' Buffer Overflow SEH Discovery by: Luis Martinez Discovery Date: 2018-09-04 Vendor Homepage:...
CVE-2018-16449
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...
EmpireCMS Cross-Site Request Forgery Vulnerability
EmpireCMS Empire Website Management System is a content management system CMS. A cross-site request forgery vulnerability exists in EmpireCMS version 7.0, which can be exploited by remote attackers to add administrators with the help of the upload/e/admin/user/AddUser.php?enews=AddUser interface...
Online Quiz Maker 1.0 - File Include Vulnerability
Exploit for php platform in category web applications Exploit Title: Online Quiz Maker 1.0 - File Include Vulnerability Vendor Homepage: https://www.hscripts.com/scripts/php/quiz-maker.php Software Link:https://www.hscripts.com/scripts/php/downloads/quiz-maker.zip Version: 1.0 Category: Webapps P...
EasyCMS Cross-Site Request Forgery Vulnerability
EasyCMS is a scalable lightweight open source content management system CMS written in PHP. Cross-site request forgery vulnerability exists in EasyCMS version 1.5, which can be exploited by remote attackers to add a regular user and update the administrator password with the help of...