9000 matches found
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
Directory traversal
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12479
VULNERABILITY SUMMARY: TeamPass 2.1.27.36 is affected by a PHP file include (directory traversal) vulnerability triggered through crafted HTTP requests to sources/users.queries.php with the newValue parameter. The issue allows any authenticated TeamPass user to cause inclusion of arbitrary files,...
gyges.org Open Redirect vulnerability
Open Bug Bounty ID: OBB-1145820 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting gyges.org website and its users. Following coordinat...
ALPINE-CVE-2019-12521
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elemen...
holz-becker.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1142773 Security Researcher Hchabik Helped patch 2358 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting holz-becker.com website and...
Privilege Escalation
The Apache HTTP Server is vulnerable to Privilege Escalation. A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with certain "Options=" arguments, local users were not restricted from executing commands from a...
tweaksguide.com Cross Site Scripting vulnerability
Security Researcher geeknik Helped patch 8505 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting tweaksguide.com website and its users. Following coordinat...
The vulnerability of the ColdFusion software platform, related to the names of PHP functions like include or require, allows a hacker to execute arbitrary PHP code on the target system.
The vulnerability of the ColdFusion software platform relates to the names of PHP functions include or require. Exploiting this vulnerability allows a malicious actor to execute arbitrary PHP code on the target system by sending a specially crafted HTTP request...
FIBARO System Home Center 5.021 - Remote File Include
FIBARO System Home Center 5.021 - Remote File Include Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3,...
FIBARO System Home Center 5.021 - Remote File Include Vulnerability
Exploit for multiple platform in category web applications Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center...
tomcat: XSS in SSI printenv
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...
Chadha PHPKB CSV Injection Vulnerability
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A CSV injection vulnerability exists in admin/include/operations.php in Chadha PHPKB Standard Multi-Language 9. An attacker can...
Horde Groupware Webmail Edition 5.2.22 PHAR Loading
exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 source =...
Sql injection
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter...
Exploit for CVE-2020-1938
CVE-2020-1938 Tomcat-fileinclude and filered Exploita...