Code injection

DISPUTED An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an...

mozgasvilag.hu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-996034 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting mozgasvilag.hu website and...

CheerWeb has a file upload vulnerability

CheerWeb is a general-purpose website system designed with PHP+MySQL architecture, which is simple, lightweight, practical, free and shared. CheerWeb suffers from a file upload vulnerability, which can be exploited by an attacker to upload arbitrary files and gain webmaster privileges...

Openfire 4.4.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1 Affected Software: Openfire Affected Versions: 4.4.1 Vendor Homepage: https://www.igniterealtime.org/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fix...

Default credentials

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal...

Rails Arbitrary File Content Disclosure

A File disclosure vulnerability has been identified on this Rails Application. This vulnerabilities exists in Action View in rails versions 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.22.11.1 or 6.0.0.beta3 whereby a remote, unauthenticated attacker can read the contents of arbitrary files on the target system...

Improper Input Validation in simple_form

Incorrect Access Control in filemethod? in lib/simpleform/formbuilder.rb; a user-supplied string is invoked as a method call Impact For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example: erb...

citecodecrashers Pic-A-Point 1.1 - Consignment SQL Injection

citecodecrashers Pic-A-Point 1.1 - Consignment SQL Injection Exploit Title: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection Author: Cakes Discovery Date: 2019-09-26 Vendor Homepage: https://github.com/citecodecrashers/Pic-A-Point Software Link:...

F5 BIG-IP ASM Information Disclosure Vulnerability

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A security vulnerability exists in the F5 BIG-IP ASM. An attacker could exploit the vulnerability ...

EulerOS 2.0 SP3 : libnl (EulerOS-SA-2019-2051)

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compil...

Tachyon - Fast HTTP Dead File Finder

Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.5.2 User Installation Install: $...

A Leader in the 2019 Gartner Magic Quadrant for WAF, Six Years Running

Gartner has published its 2019 Gartner Magic Quadrant for Web Application Firewalls WAF and Imperva has been named a Leader for the sixth consecutive year! Along with our WAF Gateways and easy-to-deploy Cloud WAF we recently added API Security, RASP, Account Takeover Protection, Bot Management, a...

Chunked Transmission Bypass Vulnerability in Netnifty Web Application Security Protection System

Beijing Netnifty Information Technology Co., Ltd. was renamed from Lenovo Netnifty Technology Beijing Co., Ltd. which was formerly known as Lenovo Group's Information Security Division. A chunked transmission bypass vulnerability exists in the NetGuard Web Application Security Protection System,...

PT-2019-18232 · F5 · F5 Big-Ip Apm

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP ASM versions 11.5.1 through 11.5.9 F5 BIG-IP ASM versions 11.6.0 through 11.6.4 F5 BIG-IP ASM versions 12.1.0 through 12.1.4.1 F5 BIG-IP ASM versions 13.0.0 through 13.1.1.5 F5 BIG-IP ASM versions 14.0.0 through 14.0.0.5 F5 BIG-IP A...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

[SECURITY] Fedora 31 Update: python38-3.8.0~b4-1.fc31

Python 3.8 package for developers. This package exists to allow developers to test their code against a newer version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.8, update your Fedora to a newer version once Python 3.8 is stable...

College-Management-System 1.2 - Authentication Bypass

Exploit Title: College-Management-System 1.2 - Authentication Bypass Author: Cakes Discovery Date: 2019-09-14 Vendor Homepage: https://github.com/ajinkyabodade/College-Management-System Software Link: https://github.com/ajinkyabodade/College-Management-System/archive/master.zip Tested Version: 1....

CVE-2019-3761

The CVE-2019-3761 entry describes a stored cross-site scripting vulnerability in RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products released before 7.1.0 P08, specifically in the Access Request module. A remote authenticated attacker could store malicious HTML or ...

CloudBees Jenkins IBM Application Security on Cloud Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.IBM Application Security on Cloud Plugin is use...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting

Alkacon OpenCMS 10.5.x - Cross-Site Scripting Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/apollo-template Version: 10.5.x Tested on...