Openfind Mail2000 /cgi-bin/go page cross-site scripting vulnerability

Openfind Mail2000 is a Web-based e-mail system. A cross-site scripting vulnerability exists in the /cgi-bin/go page in Openfind MAIL2000 versions 6.0 and earlier and 7.0 and earlier. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker c...

CVE-2019-15072: Improper Neutralization of Input During Web Page Generation

The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting XSS vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities...

PT-2019-13969

Name of the Vulnerable Software and Affected Versions MAIL2000 versions 6.0 and 7.0 Description The issue allows for the execution of arbitrary code via the ACTION parameter in the "/cgi-bin/go" page without requiring authentication. This can be executed for any user accessing the page. It is...

PT-2019-13970

Name of the Vulnerable Software and Affected Versions MAIL2000 versions 6.0 and 7.0 Description The issue is related to a cross-site scripting XSS vulnerability in the login feature of the "/cgi-bin/portal" endpoint, allowing the execution of arbitrary code via any parameter. This affects many ma...

PT-2019-14576

Name of the Vulnerable Software and Affected Versions GNU Serveez versions prior to 0.2.3 Description The issue allows an attacker to send an HTTP POST request to the "/cgi-bin/reader" API endpoint, including a Content-length header with a large positive value that, when represented in 32-bit...

Openfind MAIL2000 /cgi-bin/portal Login Function Cross-Site Scripting Vulnerability

Openfind Mail2000 is a Web-based e-mail system. A cross-site scripting vulnerability exists in the login function of /cgi-bin/portal in Openfind Mail2000 versions 6.0 and earlier and 7.0 and earlier. The vulnerability stems from a lack of proper validation of client data by the WEB application. A...

CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

PT-2019-15771

Name of the Vulnerable Software and Affected Versions PHICOMM K2PSG1218 version V22.5.9.163 Description The issue allows remote authenticated users to execute any command via shell metacharacters in the autoUpTime parameter of the /usr/lib/lua/luci/controller/admin/autoupgrade.lua file. This can ...

CVE-2019-19117: Improper Neutralization of Special Elements used in an OS Command

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

Xfilesharing 2.5.1 - Arbitrary File Upload

Xfilesharing 2.5.1 - Arbitrary File Upload Exploit Title: Xfilesharing 2.5.1 - Arbitrary File Upload Google Dork: inurl:/?op=registration Date: 2019-11-4 Exploit Author: Noman Riffat Vendor Homepage: https://sibsoft.net/xfilesharing.html Version: Shell : http://xyz.com/cgi-bin/temp/joe/shell.php...

PT-2019-15730

Name of the Vulnerable Software and Affected Versions Xfilesharing versions through 2.5.1 Description The issue allows for arbitrary file upload via the cgi-bin/up.cgi endpoint. This can potentially be combined with other issues to achieve remote code execution by uploading a .html file containin...

Multiple D-Link Products Trust Management Issue Vulnerabilities

The D-Link DIR-600 B1, among others, is a wireless router from AUO D-Link of Taiwan, China. A trust management issue vulnerability exists in multiple D-Link products, which originates from a program with a hard-coded account that can be exploited by an attacker to obtain a remote /bin/sh shell an...

CVE-2019-18952: Unrestricted Upload of File with Dangerous Type

SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP...

Debian: Security Advisory (DLA-1984-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Two Former Twitter Employees Caught Spying On Users For Saudi Arabia

Two former employees of Twitter have been charged with spying on thousands of Twitter user accounts on behalf of the Saudi Arabian government, likely with the purpose of unmasking the identity of dissidents. According to an indictment filed on November 5 and unsealed just yesterday, one of the...

CVE-2013-0165: Improper Input Validation

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp...

Linux/x86 - (NOT|ROT+8 Encoded) execve(/bin/sh) null-free Shellcode (47 bytes)

Title: Linux/x86 NOT|ROT+8 Encoded execve/bin/sh null-free Shellcode 47 bytes Author: Daniel Ortiz Date: 2019-10-30 Tested on: Linux 4.18.0-25-generic 26 Ubuntu Size: 47 bytes SLAE ID: PA-9844 ----------------------- execve ------------------------------------------------ global start section .te...

Linux/x86 - execve(/bin/sh) socket reuse Shellcode (42 bytes)

Exploit Name: Linux/x86 - execve/bin/sh socket reuse Shellcode 42 bytes Author : WangYihang Tested on: Linuxx86 Shellcode Length: 42 CVE: N/A ;================================================================================ Shellcode : char shellcode =...

CVE-2019-17367: Cross-Site Request Forgery (CSRF)

OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/...

java-1.8.0-openjdk security update

1:1.8.0.232.b09-0 - Update to aarch64-shenandoah-jdk8u232-b09. - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:1.8.0.232.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u232-b08. - Resolves: rhbz1753423...