Oracle WebLogic Remote Diagnosis Assistant Information Disclosure Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle WebLogic Remote Diagnosis Server. The specific flaw exists within the Remote Diagnosis Assistant, which listens on TCP port 8888 when enabled. The issue results from unrestricted access to th...

Reservo Image Hosting Script 1.5 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting Date: 15-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: reservo.co Version: 1.6 CVE-ID: CVE-2018-5705 With support...

Improper Grant Of Access

github.com/koding/koding is vulnerable to improper grant of access. The vulnerability exists as a user can gain admin access on koding when the user is invited, by an admin, as a user to the team...

CVE-2017-16743

An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing t...

Xnami 1.0 - Cross-Site Scripting

Xnami 1.0 - Cross-Site Scripting Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID:...

CVE-2017-15637

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptpserver.lua file...

Vanilla Forums Cross Site Request Forgery

Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432 Google Dork: NA Date: 7/1/2018 Contact: https://twitter.com/anandm47 website: https://anandtechzone.blogspot.in Exploit Author: Anand Meyyappan Vendor Homepage: https://open.vanillaforums.com Software Link:...

Vanilla < 2.1.5 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432 Google Dork: NA Date: 7/1/2018 Contact: https://twitter.com/anandm47 website: https://anandtechzone.blogspot.in Exploit Author: Anand Meyyappan Vendor Homepage:...

Vanilla 2.1.5 - Cross-Site Request Forgery

Vanilla 2.1.5 - Cross-Site Request Forgery Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432 Google Dork: NA Date: 7/1/2018 Contact: https://twitter.com/anandm47 website: https://anandtechzone.blogspot.in Exploit Author: Anand Meyyappan Vendor Homepage:...

Cross site request forgery (csrf)

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access...

CVE-2017-1000432

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access...

CVE-2017-1000432

Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access...

SEMCMS_ASP_ v4.5 has CSRF and Arbitrary File Write Vulnerabilities

SemCMS is an open source foreign trade enterprise website management system, written in vbscript language, combined with iis running, SemCMS is very suitable for foreign trade enterprises, e-commerce Internet use. SEMCMSASP v4.5 exists CSRF and arbitrary file writing vulnerability. Attackers can...

Cambium Networks ePMP Command Injection Vulnerability

Cambium Networks ePMP is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. A security vulnerability exists in Cambium Networks ePMP using firmware version 3.5 and prior, which stems from the We...

CVE-2017-5259

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https:///adm/syscmd.asp...

CVE-2017-17777

Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter...

PT-2017-15701 · D Link · D-Link Dir-330 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-130 version 1.23 D-Link DIR-330 version 1.12 Description: The issue allows a remote attacker to bypass authentication on the remote login page. By manipulating the POST request, an attacker can access administrator-only pages, such...

The vulnerability of the IBM WebSphere Commerce, Commerce on Cloud, and WebSphere Commerce Developer software lies in data processing errors. This allows attackers to disclose sensitive information, perform actions on behalf of administrators, or cause service interruptions.

The vulnerability of the IBM WebSphere Commerce, Commerce on Cloud, and WebSphere Commerce Developer software platforms lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, perform actions on behalf of...

iSmartAlarm CubeOne Arbitrary Command Execution Vulnerability

iSmartAlarm is a DIY smart home security system that allows for self-monitoring and self-control, and Cube One is the control center of this smart system. An arbitrary command execution vulnerability exists in iSmartAlarm CubeOne. An attacker can exploit this vulnerability to execute arbitrary...

Security Advisory - Multiple Vulnerabilities in Intel Management Engine Firmware

There are multiple vulnerabilities in Intel Management Engine ME firmware. Some Huawei devices are affected for using related Intel products. Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system t...