Intex Router N-150 - Cross-Site Request Forgery (Add Admin)

Intex Router N-150 - Cross-Site Request Forgery Add Admin Exploit Title:​​ Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be execute...

Command injection

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...

CVE-2018-8831

A Persistent XSS vulnerability exists in Kodi formerly XBMC through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist...

CVE-2018-0556

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

[slackware-security] patch

New patch packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/patch-2.7.6-i586-1slack14.2.txz: Upgraded. Fix arbitrary shell execution possible with obsolete ed...

Frog CMS 0.9.5 Cross Site Request Forgery

Exploit Title:aa Cross Site Request Forgery- Frog CMS Date: 31-03-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://github.com/philippe/FrogCMS Version: 0.9.5 CVE : CVE-2018-8908 Category: Webapp CMS 1...

Design/Logic Flaw

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

WOOF WooCommerce Products Filter 1.1.9 LFI / Code Execution Exploit

WOOF WooCommerce Products Filter from PluginUs.Net version 1.1.9 suffers from shortcode execution and local file inclusion vulnerabilities. ======================================================================= title: Arbitrary Shortcode Execution & Local File Inclusion product: WOOF - WooCommer...

Security feature bypass

A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using specially crafted requests to the vnewmeeting.php page. Successful exploit could...

Security update for cups (important)

This update for cups fixes the following issues: - CVE-2017-18190: Removed localhost.localdomain from list of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP command execution in conjunction with DNS rebinding. bsc1081557 This update was imported from the SUSE:SLE-12:Update update...

CVE-2017-12552

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

Command injection

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

Command injection

An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found...

Command injection

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

Design/Logic Flaw

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

NewsBee CMS SQL Injection Vulnerability

NewsBee CMS is a news website CMS Content Management System. A SQL injection vulnerability exists in NewsBee CMS. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

USN-3515-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerability

It was discovered that Ruby allows FTP command injection. An attacker could use this to cause arbitrary command execution...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

Cross site scripting

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

Zivif PR115-204-P-RS Remote Command Injection Vulnerability

The Zivif PR115-204-P-RS is a webcam device. A remote command injection vulnerability exists in Zivif PR115-204-P-RS version 2.3.4.2103. A remote attacker can exploit this vulnerability to inject arbitrary commands...