SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SysAid Help Desk Administrator Portal Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerabili...

SysAid Help Desk Arbitrary File Download

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. First, an information disclosure vulnerability CVE-2015-2997 is used to obtain the file system path, and then we abuse a directory traversal CVE-2015-2996 ...

IdeaCMS built Station system universal vulnerability affects thousands of sites-vulnerability warning-the black bar safety net

IdeaCMS based on the ASP+MSSQL/ACCESS technology development from 2 0 0 8 released in the first version since, every year, we are on a program to do a larger version of the update, so far has released six major versions. IdeaCMS in a simple, efficient, flexible, easy to use, open source, template...

phpcms front Desk arbitrary code execution php must be less than 5. 3-the vulnerabilities and early warning-the black bar safety net

phpcms v9 string2arrayfunction using the eval function,in more than one place may cause code execution vulnerability /phpssoserver/phpcms/libs/functions/global.func.php | 1 2 3 4 5 6 7 8 9 1 0 1 1 | / Converts a string to an array @param string $data the string @return array returns the array...

Cisco TelePresence Collaboration Desk and Room Endpoints TC Software Open Redirect Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco. An open redirection vulnerability exists in the login page of Cisco TC Software versions prior to 6.3-26 and prior to 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints appliances, which could allow an...

Cisco TelePresence Collaboration Desk and Room Endpoints TC Software Cross-Site Scripting Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco. A cross-site scripting vulnerability exists in the login page of Cisco TC Software versions prior to 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints appliances, which allows remote attackers to exploi...

CVE-2015-0696

Cross-site scripting XSS vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977...

Open redirect

Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ...

Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability

A vulnerability within the login page of the web user interface of Cisco TelePresence Collaboration Desk and Room Endpoints devices running TC Software could allow an unauthenticated, remote attacker to conduct HTML redirection attacks. The vulnerability is due to improper input validation of...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

Manage Engine AD Audit Manager Plus Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications Title:- Reflected cross-site scriptingXSS Vulnerability in Manage Engine AD Audit Manager Plus Admin PanelBuild 6270 Author: Harish Ramadoss - Help AG Middle East Vendor: ZOHO Corp Product: Manage Engine AD Audit Manager Plus Version: All...

A common Site Management System any user login/SQL injection/GetShell vulnerabilities source code analysis-vulnerability warning-the black bar safety net

Brief description: This system is not open source, most of the universities in use, turn the source off at the next Detailed description: 0x00 General case: code area Manufacturer: Rio Tinto tech Official website: http://www.ltpower.net/ The main is to do the educational products of the...

Cisco Collaboration Desk Experience Endpoints Command Injection Vulnerability

A vulnerability in the image upgrade facility of Cisco Collaboration Desk Experience DX Series endpoints could allow an authenticated, local attacker to execute commands in the context of the underlying operating system. The vulnerability is due to insufficient sanitization of input during the...

ManageEngine ServiceDesk Plus 'CreateReportTable.jsp' SQL Injection Vulnerability

ServiceDesk Plus is web-based helpdesk software that helps users manage all their communications from a single point. ManageEngine ServiceDesk Plus 'CreateReportTable.jsp' has a SQL injection vulnerability due to the program failing to adequately filter user-supplied data before using it in SQL...

OTRS Help Desk Security Mechanism Bypass Vulnerability

OTRS Help Desk is an open source resource service management solution. A security mechanism bypass vulnerability exists in OTRS Help Desk versions 3.2.x prior to 3.2.17, 3.3.x prior to 3.3.11, and 4.0.x prior to 4.0.3, which allows remote authenticated users to access and modify arbitrary tickets...

OTRS 3.2.x < 3.2.17, 3.3.x < 3.3.11, 4.x < 4.0.3 Help Desk Privilege Escalation Vulnerability (Dec 2014)

Open Ticket Request System OTRS Help Desk is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...

CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...

Design/Logic Flaw

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...

CVE-2014-9324

The GenericInterface in OTRS Help Desk 3.2.x before 3.2.17, 3.3.x before 3.3.11, and 4.0.x before 4.0.3 allows remote authenticated users to access and modify arbitrary tickets via unspecified vectors...