848 matches found
PT-2019-2935 · Cisco · Cisco Enterprise Nfv Infrastructure
Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software NFVIS affected versions not specified Description: A vulnerability in the Virtual Network Computing VNC console implementation could allow an unauthenticated, remote attacker to access the VNC...
CVE-2018-7064
A reflected cross-site scripting XSS vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session...
CVE-2019-0018
A persistent cross-site scripting XSS vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...
CVE-2018-1000847
FreshDNS version 1.0.3 and prior contains a Cross Site Scripting XSS vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Ful...
Remote Code Execution (RCE)
github.com/gogs/gogs is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the ability to forge a session-file in file.go, allowing unauthenticated users to obtain an admin session, and subsequently allowing remote code to be injected...
phptpoint Hospital Management System 1.0 - 'user' SQL injection
Exploit Title: phptpoint Hospital Management System 1.0 - 'user' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: Version: 1 Tested on: WAMP windows 10 x64 CVE: unknown Description: Phptpoin...
phptpoint Hospital Management System 1.0 - user SQL injection
phptpoint Hospital Management System 1.0 - user SQL injection Exploit Title: phptpoint Hospital Management System 1.0 - 'user' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: Version: 1...
Fastspot Bigtree Session Fixation Vulnerability
Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A session fixation vulnerability exists in Fastspot Bigtree that stems from the fact that after a user logs into the application, the admin.php file receives the PHP session ID...
CVE-2018-18380
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
Session fixation
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-18380
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-18380: Session Fixation
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-0059
A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...
Vanilla: Vanilla Forums AddonManager getSingleIndex Directory Traversal File Inclusion Remote Code Execution Vulnerability
Summary: An authenticated admin user can trigger a directory traversal to require call leading to local file inclusion which can allow an attacker to gain remote code execution. Notes: - You need to have an admin session to run this poc. - You can use the directory traversal to reach outside of t...
Authentication flaw
It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...
PT-2018-13926 · Western Digital · Western Digital My Cloud
Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud versions prior to 2.30.196 Description: The issue allows an unauthenticated attacker to bypass authentication and gain full control of the device by exploiting a vulnerability in the authentication mechanism...
CVE-2018-17153: Improper Authentication
It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...
Information disclosure
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses...