9890 matches found
CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...
[SECURITY] Fedora 28 Update: guacamole-server-1.0.0-1.fc28
Guacamole is an HTML5 remote desktop gateway. Guacamole provides access to desktop environments using remote desktop prot ocols like VNC and RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No browser plugins are needed, and no clie...
TeamCity < 9.0.2 - Disabled Registration Bypass Exploit
TeamCity 9.0.2 - Disabled Registration Bypass Exploit var login = 'testuser'; //логин пользователя var password = 'SuperMEgaPa$$'; //пароль var email = 'email protected'; // email / Code / var b = BS.LoginForm; var publickey = $F"publicKey"; var encryptedpass = BS.Encrypt.encryptDatapassword,...
phpBB 3.2.3 - Remote Code Execution Exploit
Exploit for php platform in category web applications phpBB 3.2.3 - Remote Code Execution Exploit // All greets goes to RIPS Tech // Run this JS on Attachment Settings ACP page var pluploadsalt = ''; var formtoken = ''; var creationtime = ''; var filepath =...
FreeBSD : rt -- XSS via jQuery (416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42)
BestPractical reports : The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longe...
rt -- XSS via jQuery
BestPractical reports: The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longer...
vBulletin 4.2.5 Ajax Threads 1.1.3 Lite Open Redirection
Exploit Title : vBulletin 4.2.5 Ajax Threads 1.1.3 Lite Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : vbulletin.com dragonbyte-tech.com Software Information Link : dragonbyte-tech.com/store/ajax-threads.114/ Softwa...
Ultimate Membership Pro <= 7.5 - Arbitrary media upload
The ajax-upload.php endpoint doesn't check for the current user's capabilities or that they are even logged in, so we can do a few things we shouldn't be able to do: Without any credentials, you can simply POST the image file in the field ihcfile and it'll store it for you: $ curl -F...
Ultimate Membership Pro 7.4.2 <= 7.5 - Arbitrary media include
In addition to cropping/rotating/resizing an image of your choosing, you can abuse the imgUrl feature on versions that it's available on 7.4.2+ at least to make an HTTP request to any site you want. For example, by having it connect to a site you control, you can determine the IP address of the...
Path traversal
tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file jpg/jpeg/png via path traversal with the path parameter, through the saveimg action in ajaxcalls.php...
Path traversal
tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the getfile action in ajaxcalls.php...
Joomla Geommunity3es 1.4 SQL Injection
Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : nordmograph.com Software Download Link : nordmograph.com/extensions /index.php?option=comvirtuemart&view=productdetails...
C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection
Exploit Title: C4G Basic Laboratory Information System BLIS 3.4 - Multiples SQL Injection Date: 01/31/2019 Software Links/Project: https://github.com/C4G/BLIS | http://blis.cc.gatech.edu/index.php Version: C4G Basic Laboratory Information System v3.4 Exploit Author: Carlos Avila Category: webapps...
ZoneMinder SQL Injection Vulnerability (CNVD-2019-04687)
ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. SQL injection vulnerability exists in the ajax/status.php file in versions prior to ZoneMinder 1.32.3, which can be exploited by remote attackers to execute SQL commands with...
The vulnerability of Juniper Networks Junos Space, a platform for managing network resources, related to insufficient access control, allows attackers to delete information from the internal database.
The vulnerability of Juniper Networks’ Junos Space network resource management platform is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to delete information from the internal database using specially crafted Ajax requests...
GHSA-QMV4-JGP7-MF68 Sails before 0.12.7 vulnerable to Broken CORS
Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML...
Sails before 0.12.7 vulnerable to Broken CORS
Affected versions of sails have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML...
CVE-2019-8429
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...