CVE-2017-17825

The CVE-2017-17825 entry affects Piwigo 2.9.2, specifically the Batch Manager component. The vulnerability is a Persistent Cross-Site Scripting (stored XSS) triggered by tags-* array parameters in the admin.php?page=batch_manager&mode=unit request, which can allow an attacker to hijack a user’s b...

CVE-2017-17824

The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batchmanagerunit.php elementids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database...

CVE-2017-17824

The CVE-2017-17824 entry describes a SQL Injection in Piwigo 2.9.2’s Batch Manager component. Specifically, the admin/batch_manager_unit.php element_ids parameter in unit mode can be exploited to access data in the connected MySQL database. Root cause: an unsafely handled parameter likely leads t...

Piwigo admin/configuration.php file cross-site request forgery vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site request forgery vulnerability exists in the admin/configuration.php...

OpenText Documentum Content Server - Privilege Escalation

!/usr/bin/env python Opentext Documentum Content Server formerly known as EMC Documentum Content Server contains following design gap, which allows authenticated user to gain privileges of superuser: Content Server allows to upload content using batches TAR archives, when unpacking TAR archives...

SaltStack Salt Code Execution Vulnerability

SaltStack Salt a.k.a. SaltStack is an open source set of tools for managing infrastructure from the American company SaltStack. A security vulnerability exists in SaltStack Salt. The vulnerability can be exploited by an attacker to execute code when using the localbatch client...

PYSEC-2017-38

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

Aerospike Database Server Client Batch Request Code Execution Vulnerability(CVE-2016-9051)

Summary An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attack...

[SECURITY] Fedora 25 Update: converseen-0.9.6.2-3.fc25

Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!...

[SECURITY] Fedora 26 Update: converseen-0.9.6.2-3.fc26

Converseen is a batch image conversion tool and resizer written in C++ with Qt5 and Magick++. Converseen allows you to convert images in more than 100 different formats!...

MSFPC - MSFvenom Payload Creator

MSFvenom Payload Creator MSFPC is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as simple as possible only requiring one input to produce their payload. Fully automating msfvenom & Metasploit is the end goal well as to be be able to automate MSFPC...

Cisco Prime Collaboration Provisioning Tool Arbitrary File Overwrite Vulnerability

Cisco Prime Collaboration Provisioning Tool is a set of Web-based, next-generation communications services tools from Cisco. The tool provides IP communication services capabilities for IP telephony, voice mail and unified communications environments. A security vulnerability exists in the batch...

CVE-2017-6792

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

CVE-2017-6792

CVE-2017-6792 : Cisco Prime Collaboration Provisioning Tool’s batch provisioning feature is vulnerable due to lack of input validation of parameters in BatchFileName and Directory. An authenticated, remote attacker could exploit this to overwrite system files as root. Root cause and impact are de...

Cisco Prime Collaboration Provisioning Tool System File Overwrite Vulnerability

A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and Directory. An attacker coul...

MSFvenom Payload Creator: MSFPC

MSFvenom Payload Creator MSFPC is a wrapper to generate multiple types of payloads, based on users choice. The idea is to be as simple as possible only requiring one input to produce their payload. Fully automating msfvenom & Metasploit is the end goal well as to be be able to automate MSFPC itse...

Cross-site Request Forgery (CSRF)

spring-batch-admin is vulnerable to cross-site request forgery CSRF attacks. The library does not use CSRF tokens, allowing a malicious user to hijack the authentication of other users and submit arbitrary requests through the file upload page...

Pivotal Software Spring Batch Admin Cross-Site Request Forgery Vulnerability

Pivotal Software Spring Batch Admin is a monitoring and management tool from Pivotal Software, USA. A cross-site request forgery vulnerability exists in Pivotal Software Spring Batch Admin versions prior to 1.3.0. A remote attacker can exploit this vulnerability to perform unauthorized operations...

Pivotal Software Spring Batch Admin Cross-Site Scripting Vulnerability

Pivotal Software Spring Batch Admin is a monitoring and management tool from Pivotal Software, USA. A cross-site scripting vulnerability exists in Pivotal Software Spring Batch Admin versions prior to 1.3.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML v...

CVE-2017-12881

Cross-site request forgery CSRF vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability...