CVE-2018-12468

A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution...

CVE-2018-12468 Arbitrary File Upload in GroupWise Administration Console

A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution...

Cross site scripting

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. T...

PT-2018-5033 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman version 1.5.1 Description: A flaw in the remote execution plugin allows commands to be run on hosts over SSH from the Foreman web UI. When a job containing HTML tags is submitted, the console output in the web UI does not escape the...

Veeam Availability Console U1 Cumulative Patch 1807

Challenge Veeam Availability Console U1 Cumulative Patch 1807. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1807. You can check this under Windows Programs and features. After upgrading, your build will be version 2.0.2.1807. Solution...

SoftNAS Cloud OS Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SoftNAS Cloud OS Command Injection 1. Advisory Information Title: SoftNAS Cloud OS Command Injection Advisory ID: CORE-2018-0009 Advisory URL: http://www.coresecurity.com/advisories/softnas-cloud-OS-command-injection Date...

The vulnerability of the console-io command shell in Node.js, related to authentication process flaws, allows attackers to execute arbitrary code.

The vulnerability of the console-io command shell for Node.js is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by connecting to the console using websocket...

CVE-2018-14335

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files outside of their permissions via a symlink to a fake database file...

Dashbuilder: Lack of clickjacking protection on the login page

It was discovered that the Dashbuilder login page could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability (CNVD-2018-13568)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

QNAP Qcenter Virtual Appliance Information Disclosure (CVE-2018-0706)

An Information disclosure vulnerability exists in QNAP Qcenter Virtual Appliance web console. Successful exploitation of this vulnerability would allow an authenticated user to obtain sensitive information...

homol.ssl.fastsolutions.com.br Improper Access Control vulnerability

Open Bug Bounty ID: OBB-647607 Description| Value ---|--- Affected Website:| homol.ssl.fastsolutions.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:|...

catalyst.cfive.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-647603 Description| Value ---|--- Affected Website:| catalyst.cfive.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

apps.diresacallao.gob.pe Improper Access Control vulnerability

Open Bug Bounty ID: OBB-647595 Description| Value ---|--- Affected Website:| apps.diresacallao.gob.pe Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

zhenlin.kdcredit.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-647593 Description| Value ---|--- Affected Website:| zhenlin.kdcredit.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Multiple Bugs Found in QNAP Q’Center Web Console

Researchers found an array of high severity vulnerabilities in network storage vendor QNAP’s web console, which could enable an authenticated attacker to gain privileges and execute arbitrary commands on the system. The web-based platform, Q’center, allows users to manage network attached storage...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

Cross site scripting

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2432

SAP BusinessObjects Business Intelligence BI Launchpad and Central Management Console versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including:...

CVE-2018-2432

CVE-2018-2432 affects SAP BusinessObjects BI Launchpad and Central Management Console (versions 4.10, 4.20, 4.30). The issue allows an attacker to include invalid data in the HTTP response header sent to a web user, enabling cross-site scripting and page hijacking as stated in the public descript...