CVE-2017-17825: Improper Neutralization of Input During Web Page Generation

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

PT-2017-15029

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue concerns SQL Injection in the Batch Manager component of Piwigo. Specifically, the element ids parameter in the "admin/batch manager unit.php" endpoint is vulnerable when in unit mode. This allows an...

PT-2017-15032

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows an attacker to perform Cross-Site Request Forgery attacks, potentially coercing an admin user into performing unintended actions. This can be achieved via the...

CVE-2017-17824: Improper Neutralization of Special Elements used in an SQL Command

The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batchmanagerunit.php elementids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database...

PT-2017-15030

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue concerns a Persistent Cross Site Scripting vulnerability in the Batch Manager component. This can be exploited via the tags- array parameters in an "admin.php?page=batch manager&mode=unit" request. An...

Piwigo admin/configuration.php file cross-site request forgery vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site request forgery vulnerability exists in the admin/configuration.php...

OpenText Documentum Content Server - Privilege Escalation

!/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains following design gap, which allows authenticated user to gain privileges of superuser: Content Server allows to upload content using batches TAR archives, when unpacking TAR archives...

SaltStack Salt Code Execution Vulnerability

SaltStack Salt a.k.a. SaltStack is an open source set of tools for managing infrastructure from the American company SaltStack. A security vulnerability exists in SaltStack Salt. The vulnerability can be exploited by an attacker to execute code when using the localbatch client...

PYSEC-2017-38

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

Aerospike Database Server Client Batch Request Code Execution Vulnerability(CVE-2016-9051)

Summary An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attack...

[SECURITY] Fedora 25 Update: converseen-0.9.6.2-3.fc25

Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!...

[SECURITY] Fedora 26 Update: converseen-0.9.6.2-3.fc26

Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!...

MSFPC - MSFvenom Payload Creator

MSFvenom Payload Creator MSFPC is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as simple as possible only requiring one input to produce their payload. Fully automating msfvenom & Metasploit is the end goal well as to be be able to automate MSFPC...

Cisco Prime Collaboration Provisioning Tool Arbitrary File Overwrite Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. A security vulnerability exists in the batch...

CVE-2017-6792

CVE-2017-6792 : Cisco Prime Collaboration Provisioning Tool’s batch provisioning feature is vulnerable due to lack of input validation of parameters in BatchFileName and Directory. An authenticated, remote attacker could exploit this to overwrite system files as root. Root cause and impact are de...

CVE-2017-6792

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

PT-2017-17325

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Tool affected versions not specified Description A vulnerability in the batch provisioning feature could allow an authenticated, remote attacker to overwrite system files as root. This issue is due to a...

Cisco Prime Collaboration Provisioning Tool System File Overwrite Vulnerability

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

MSFvenom Payload Creator: MSFPC

MSFvenom Payload Creator MSFPC is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as simple as possible only requiring one input to produce their payload. Fully automating msfvenom & Metasploit is the end goal well as to be be able to automate MSFPC itse...

Cross-site Request Forgery (CSRF)

spring-batch-admin is vulnerable to cross-site request forgery CSRF attacks. The library does not use CSRF tokens, allowing a malicious user to hijack the authentication of other users and submit arbitrary requests through the file upload page...