2550 matches found
Node.js third-party modules: Reflected XSS in the npm module express-cart.
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report Reflected XSS in...
CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTPS. Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's...
OneThink Cross-Site Request Forgery Vulnerability (CNVD-2018-14976)
Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/User/add.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to add users...
Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)
Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10 Firefox/Chrome CVE : N/A 1. Description CSRF vulnerability in...
CVE-2017-9002
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or password...
onArcade 2.4.2 - Cross-Site Request Forgery (Add Admin)
Exploit Title: Cross-Site Request Forgery Add Admin Google Dork: Powered by onArcade v2.4.2 Date: 2018/August/4 Author: r3m0t3nu11Zero-way Software Link: "http://www.onarcade.com" Version: "Uptodate" the appilication is vulnerable to CSRF attack No CSRF token in place meaning that if an admin use...
onArcade 2.4.2 - Cross-Site Request Forgery (Add Admin)
onArcade 2.4.2 - Cross-Site Request Forgery Add Admin Exploit Title: Cross-Site Request Forgery Add Admin Google Dork: Powered by onArcade v2.4.2 Date: 2018/August/4 Author: r3m0t3nu11Zero-way Software Link: "http://www.onarcade.com" Version: "Uptodate" the appilication is vulnerable to CSRF atta...
Imperva SecureSphere 11.5 / 12.0 / 13.0 - Privilege Escalation
Title: Imperva SecureSphere = v13 - Privilege Escalation Author: 0x09AL Date: 01/08/2018 Tested on: Imperva SecureSphere 11.5,12.0,13.0 Vendor: https://www.imperva.com/ Vulnerability Description There is a program named PCE.py which runs as root and starts a unix domain socket listener in...
CVE-2018-14777
An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...
Authorization
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect authorization check in backend/server/rhnChannel.py...
Privilege Escalation
express-cart is vulnerable to privilege escalation attacks. A malicious user can pass a crafted request to the endpoint containing the /admin/setup string to create a user that will be considered as an admin user...
Cross site request forgery (csrf)
CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...
CVE-2018-14029
CVE-2018-14029 : CSRF in the WityCMS 0.6.2 admin/user/edit flow allows an attacker to take over a user account by modifying user data (e.g., email, password). The vulnerability stems from cross-site request forgery in the admin interface, with CVSSv3 base score 8.8 (HIGH) and user interaction req...
CVE-2018-11447
CVE-2018-11447 affects Siemens SCALANCE M875 devices. The vulnerability is a CSRF flaw in the web interface (port 443/tcp) that can allow an authenticated administrative user to interact with the interface as an administrative user when a user is lured to a malicious link. Impact described includ...
Udemy: [affiliates.udemy.com] Wordpress user admin information discloure
Summary This website using Wordpress CMS, so developer forget to disable the link that can view information of admin user. By access to this link, attacker can get all username and other information of user admin: http://affiliates.udemy.com/wp-json/wp/v2/users F312155 Admin user list: hamza...
Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
Exploit Title: Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source of request. This leads to arbitra...
Intex Router N-150 Cross Site Request Forgery
Exploit Title:aa Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source of request. This leads to...
Intex Router N-150 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Intex Router N-150 - Cross-Site Request Forgery Add Admin Exploit Author: Navina Asrani Version: N-150 Category: Router Firmware 1. Description The firmware allows malicious request to be executed without verifying source...
Unspecified Vulnerability in expressCart
expressCart is a shopping cart module used in Node.js. A security vulnerability exists in expressCart. A remote attacker can exploit this vulnerability to create an admin user...
