CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2016-5422

The CVE-2016-5422 issue affects Red Hat JBoss Operations Network (JON) prior to 3.3.7. The web console fails to properly authorize requests to add users with the super user role, enabling remote authenticated users to elevate privileges to admin via a crafted POST. The widely cited Red Hat adviso...

OpenCart 2.0.3.1 Cross Site Scripting

OpenCart 2.0.3.1 Cross Site Scripting Vulnerability Information -------------------- Author: Hamed Izadi Email: "hamedizadi", "@", "gmail", ".com"; Name: XSS Vulnerability in OpenCart Affected Software : OpenCart Affected Versions: v2.0.3.1 and possibly below Vendor Homepage :...

Arbitrary Login Vulnerability in RAS System of Shenzhen Comay Communication Technology Co.

Techmart iRAS Remote Application Solution is a remote rapid application access solution that combines TS terminal technology to provide network interconnection architecture while centrally distributing a variety of applications, including Web applications. There is an arbitrary login vulnerabilit...

NUUO NVRmini 2 Cross-Site Request Forgery Vulnerability

NUUO provides a stable and high performance digital networked surveillance system. NUUO NVRmini 2 Cross-Site Request Forgery Vulnerability. When a logged in user visits a malicious web site, an attacker can exploit this vulnerability to perform certain actions with administrative privileges...

Open Upload 0.4.2 - Cross-Site Request Forgery (Add Admin)

Exploit for php platform in category web applications ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Open Upload 0.4.2 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications ================================================================================================================ Open Upload 0.4.2 Remote Admin Add CSRF Exploit and Changing Normal user permission...

Assistive Technologies Persistence

This module achieves persistence by registering a custom Assistive Technology AT in the Windows registry. Then it configures the system to launch the AT executable during user logon or desktop switch such as with an admin prived program. Requires Windows 8 or higher and administrative privileges...

Wowza Streaming Engine 4.5.0 Cross Site Request Forgery

i? Wowza Streaming Engine 4.5.0 CSRF Add Advanced Admin Exploit Vendor: Wowza Media Systems, LLC. Product web page: https://www.wowza.com Affected version: 4.5.0 build 18676 Platform: JSP Summary: Wowza Streaming Engine is robust, customizable, and scalable server software that powers reliable...

SugarCRM <= 6.5.18 Multiple Vulnerabilities

SugarCRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sugarcrm:sugarcrm"; if description...

Vulnerability of Microsoft Office software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information

A vulnerability that allows for remote execution of code exists in Microsoft Office and is related to the processing of certain properties of Microsoft Word files. If a user with administrative privileges accesses the system, a malicious individual can gain full control over the system. They can...

The vulnerability in Microsoft OneNote’s software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in Microsoft OneNote and is related to the processing of specially crafted files. Exploiting this vulnerability enables a malicious individual to execute arbitrary code within the context of the current user. If a user with...

Vulnerability of Microsoft Office Web Apps, which allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The vulnerability of Microsoft Office Web Apps allows for the execution of code remotely. If a user with administrative privileges accesses the system, a malicious individual can gain full control over the system. They can install programs, view, modify, or delete data, as well as create new...

The vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability that allows for remote execution of code is related to improper processing of TrueType fonts by the kernel-level driver in Windows. If this vulnerability is exploited successfully, a malicious individual can execute arbitrary code at the kernel level. As a result, they can insta...

CVE-2016-1416

Cisco Prime Collaboration Provisioning 10.6 SP2 aka 10.6.0.10602 mishandles LDAP authentication, which allows remote attackers to obtain administrator privileges via a crafted login attempt, aka Bug ID CSCuv37513...

Cuckoo Sandbox Guest 2.0.1 Code Execution

-- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip Version: = 2.0.1 Tested on: MS Windows 7, MS...

Researcher Pockets $30,000 in Chrome Bounties

Security researcher Mariusz Mlynski is having a good month. Having cashed in earlier in May to the tune of $15,500, Mlynski pocketed another $30,000 courtesy of Google’s bug bounty program after four high-severity vulnerabilities were patched in the Chrome browser, each worth $7,500 to the...

Core Windows Utility Can Be Used to Bypass AppLocker

A core Windows command-line utility, Regsvr32, used to register DLLs to the Windows Registry can be abused to run remote code from the Internet, bypassing whitelisting protections such as Microsoft’s AppLocker. A researcher who requested anonymity found and privately disclosed the issue to...