Elasticsearch Kibana Console Plugin Command Execution Vulnerability

Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from the Dutch company Elasticsearch.Console is one of the console plug-ins. A security vulnerability exists in the Console plugin in...

Intel® RAID Web Console 3 Cross-site Scripting Vulnerability Advisory

Summary: A potential security vulnerability in the Intel® RAID Web Console RWC may allow remote manipulation of RWC console output. Intel is releasing RAID Web Console updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-3699 Description: Cross-site scripting i...

Intel® RAID Web Console 3 for Windows* Authentication Bypass Advisory

Summary: A potential security vulnerability in Intel® RAID Web Console 3 for Windows may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-3696 Description: Authentication bypass in the IntelR RAID We...

xorg-x11-server 1.20.1 - Local Privilege Escalation

xorg-x11-server 1.20.1 - Local Privilege Escalation Exploit Title: xorg-x11-server bolo console opened Building root shell wait 2 minutes crontab overwritten ... cut Xorg output ... Xorg killed II Server terminated successfully 0. Closing log file. Don't forget to cleanup /etc/crontab and /tmp di...

Oracle WebLogic Server Administration Console Detected

Oracle WebLogic Server administration console has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...

CVE-2018-15394

A vulnerability in the Stealthwatch Management Console SMC of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system...

Authentication flaw

A vulnerability in the Stealthwatch Management Console SMC of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system...

CVE-2018-15394 Cisco Stealthwatch Management Console Authentication Bypass Vulnerability

A vulnerability in the Stealthwatch Management Console SMC of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system...

Arbitrary File Inclusion

kibana is vulnerable to arbitrary file inclusion attacks. The vulnerability exists through the Kibana Console API where a request can be sent to include external JS files which could possibly result in executing arbitrary commands...

Cisco Stealthwatch Management Console Backup Authentication Bypass Vulnerability

Cisco Stealthwatch Management Console is a data collection and analysis device from cisco. Cisco Stealthwatch Management Console has a share validation bypass vulnerability that is caused by an insecure system configuration. An attacker can exploit this vulnerability by sending a crafted HTTP...

Cisco Stealthwatch Management Console Authentication Bypass Vulnerability

A vulnerability in the Stealthwatch Management Console SMC of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system...

CVE-2018-17246

Kibana, before 6.4.3 and 5.6.13, contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript code. This could possibly lead to an attacker executing arbitrary commands with permissio...

Kibana ESA-2018-18

Nethanel Coppenhagen of CyberArk Labs discovered Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to...

GHSA-9H9C-F287-C6VP Improper Control of Interaction Frequency in Apache syncope-core

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

Hardcoded credentials

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

CVE-2018-17184

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

SharpSploitConsole - Console Application Designed To Interact With SharpSploit

Console Application designed to interact with SharpSploit released by @cobbrio SharpSploit is a tool written by @cobbrio that combines many techniques/C code from the infosec community and combines it into one sweet DLL. It's awesome so check it out! Description SharpSploit Console is just a quic...

Security Bulletin: Potential traversal vulnerability in IBM WebSphere Application Server Admin Console shipped with Jazz for Service Management (CVE-2018-1770)

Summary There is a potential directory traversal vulnerability in the Admin Console for WebSphere Application Server shipped with Jazz for Service Management. Vulnerability Details CVEID: CVE-2018-1770 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse...

GHSA-HVWM-2624-RP9X Apache ActiveMQ web console vulnerable to Cross-site Scripting

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...

Apache ActiveMQ web console vulnerable to Cross-site Scripting

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...