Design/Logic Flaw

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

Sql injection

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11943

Open-AudIT 3.2.2 contains an arbitrary file upload vulnerability in the Add Image workflow. An authenticated attacker can upload a PHP file (simple-backdoor.php) via the image upload endpoint and access it to execute commands, as demonstrated by a PoC that places the backdoor under custom_images ...

CVE-2020-11943

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11942

Open-AudIT 3.2.2 contains SQL injection in device scripts via unsanitized parameters system.class and system.discovery_id, enabling an attacker to modify or execute arbitrary SQL statements (e.g., via crafted requests to /devices). PoC shows TRUE/FALSE payloads returning different response sizes,...

Microsoft Office 365 Security Recommendations

Summary As organizations adapt or change their enterprise collaboration capabilities to meet “telework” requirements, many organizations are migrating to Microsoft Office 365 O365 and other cloud collaboration services. Due to the speed of these deployments, organizations may not be fully...

Opmantek Open-AudIT Injection Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. Opmantek Open-AudIT suffers from an injection vulnerability. An attacker can exploit this vulnerability to inje...

Open-AudIT Professional 3.3.1 Remote Code Execution

Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-12078 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...

Opmantek Open-AudIT Cross-Site Scripting Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Opmantek Open-AudIT version 3.3.0. The vulnerability stems from...

Open-AudIT Professional 3.3.1 - Remote Code Execution

Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-8813 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

Design/Logic Flaw

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 is affected by a reflected/authenticated cross-site scripting vulnerability (CVE-2020-12261). The issue arises in the web interface after login, where crafted input (e.g., payloads placed in the search path) can execute client-side scripts. Public references include Exploit-DB an...

CVE-2020-12078

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...

CVE-2020-12078

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...

Design/Logic Flaw

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...

CVE-2020-12078

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...