CVE-2018-15658

An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is...

CVE-2018-15658

CVE-2018-15658 affects 42Gears SureMDM (pre-2018-11-27). The issue arises when session validation runs after initial markup on /console/ConsolePage/Master.html, allowing an attacker to view the markup that would be shown to an authenticated user and, per the vulnerability description, access unpr...

PT-2018-9483

Name of the Vulnerable Software and Affected Versions Battelle V2I Hub version 2.5.1 Description The issue allows a remote authenticated attacker to perform SQL injection. This can be achieved by sending specially-crafted SQL statements to "API Endpoints: /api/PluginStatusActions.php" and...

PT-2018-14381

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for the injection of PHP ini-file directives through environment variables. This can be achieved by sending specific information to the attacker, such as using a name parameter...

PT-2018-13525

Name of the Vulnerable Software and Affected Versions PESCMS Team version 2.2.1 Description The issue concerns multiple reflected XSS instances. These occur via the keyword parameter in several API endpoints: "g=Team&m=User&a=index&keyword=", "g=Team&m=User group&a=index&keyword=",...

Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications ======================================================================= title: SQL Injection, XSS & CSRF vulnerabilities product: Pimcore vulnerable version: 5.2.3 and below fixed version: 5.3.0 CVE number: CVE-2018-14057, CVE-2018-14058,...

PT-2018-12907

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote attacker to bypass authentication and access various API endpoints, including "portal/add edit event user.php", "portal/find appt popup user.php", "portal/get...

PT-2018-1311

Name of the Vulnerable Software and Affected Versions Microsoft Windows VBScript Engine versions prior to the fixed version Description A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affect...

PT-2018-9969

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different PHP files, including patient to /interface/main/finder/finder navigation.php, key to...

PT-2018-9945

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.7 Description: The issue concerns a physical path leakage via several API endpoints, including "/modules/DesignManager/action.ajax get templates.php", "/modules/DesignManager/action.ajax get...

Authentication flaw

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880: Improper Authentication

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

PT-2018-5118

Name of the Vulnerable Software and Affected Versions GemFire broker for Cloud Foundry versions 1.6.x through 1.6.4 GemFire broker for Cloud Foundry versions 1.7.x through 1.7.0 Description The issue concerns multiple API endpoints that do not require authentication, potentially allowing...

PT-2018-5332

Name of the Vulnerable Software and Affected Versions Wireless IP Camera 360 affected versions not specified Description An issue allows attackers to read recordings by navigating to API Endpoints: "/mnt/idea0" or "/mnt/idea1" on the SD memory card. Recommendations At the moment, there is no...

PT-2018-18068 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows remote attackers to discover the full path via a direct request to "3/qq connect2.0/API/class/ErrorCase.class.php" or "3/ucenter api/code/friend.php". Recommendations: For zzcms version 8.2, as ...

PT-2017-13235

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security Enterprise versions before 9.7 Patch 3 Description The issue allows remote attackers to execute arbitrary code on vulnerable installations. Multiple API endpoints are vulnerable to SQL Injection, including query...

JetBrains IntelliJ-based IDEs <= 2016.1 Multiple Vulnerabilities - Active Check

JetbBains IntelliJ-based IDEs are prone to a remote code execution RCE and a local file disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...