DefectDojo - Application Vulnerability Correlation And Security Orchestration Application

DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, schedule scans, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one...

CVE-2018-10570

Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...

The vulnerability of the install/index.php script of the Exponent CMS system allows a hacker to execute arbitrary code.

The vulnerability of the Exponent CMS content management system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the sc parameter in the install/index.php script...

CVE-2015-0296

The pre-install script in texlive 3.1.20140525r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory...

CVE-2015-0296

The CVE-2015-0296 entry concerns the TeX Live package scripts. The pre-install script in texlive 3.1.20140525_r34255.fc21 (Fedora 21) and texlive 6.20131226_r32488.fc20 (and related RPMs) allows an unprivileged local user to delete arbitrary files by placing a crafted file in the user’s home dire...

CVE-2015-0296

The pre-install script in texlive 3.1.20140525r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory...

CVE-2015-0296

The pre-install script in texlive 3.1.20140525r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory...

Portable Virtual Private Network: goSecure

Portable Virtual Private Network goSecure is an easy to use and portable Virtual Private Network VPN solution. The system consists of a single server and one or many clients. strongSwan is used to establish a Suite B IPsec tunnel with pre-shared keys between the server and clients. The core crypt...

Remote Command Execution Vulnerability in Next-Generation Firewall System of SinoCom-ArtM

The InforCube Next-Generation Firewall NFW is a comprehensive security gateway security solution. A remote command execution vulnerability exists in the InforCube Next Generation Firewall system. The vulnerability allows an attacker to write php code into a file by modifying the install.php post...

glusterfs: glusterfs-server %pretrans rpm script temporary file issue

It was found that glusterfs-server RPM package would write file with predictable name into world readable /tmp directory. A local attacker could potentially use this flaw to escalate their privileges to root by modifying the shell script during the installation of the glusterfs-server package...

Teradata Studio Express Elevation of Privilege Vulnerability

Teradata Studio Express is a suite of information mining tools from Teradata Teradata that retrieve data from Teradata and Aster database systems and support the manipulation and storage of data on the desktop. An elevation of privilege vulnerability exists in the installation script in Teradata...

IBM Installation Manager 1.8.1 Race Condition

Title: /tmp race condition in IBM Installation Manager V1.8.1 install script Author: Larry W. Cashdollar, @larry0 Date: 2015-10-29 Download Site: http://www-03.ibm.com/software/products/en/appserv-wasfordev Vendor: IBM Vendor Notified: 0000-00-00 Vendor Contact: Description: IBM Installation...

Cisco AnyConnect elevation of privileges via DMG install script

------------------------------------------------------------------------ Cisco AnyConnect elevation of privileges via DMG install script ------------------------------------------------------------------------ Yorick Koster, July 2015...

Web Reference Database Command Execution Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. A vulnerability in the handling of the 'adminPassword' parameter in the Web Reference Databaseinstall.php script allows remote attackers to...

Web Reference Database SQL Injection Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. A security vulnerability in the Web Reference Database install.php script handling the 'defaultCharacterSet' parameter allows remote attackers t...

Cisco AnyConnect 3.1.08009 - Privilege Escalation via DMG Install Script Exploit

Exploit for macOS platform in category dos / poc / Cisco AnyConnect elevation of privileges via DMG install script - proof of concept Yorick Koster, July 2015 https://securify.nl/advisory/SFY20150701/ciscoanyconnectelevationofprivilegesviadmginstallscript.html based on...

Cisco AnyConnect 3.1.08009 - Local Privilege Escalation (via DMG Install Script)

Cisco AnyConnect 3.1.08009 - Local Privilege Escalation via DMG Install Script / Cisco AnyConnect elevation of privileges via DMG install script - proof of concept Yorick Koster, July 2015 https://securify.nl/advisory/SFY20150701/ciscoanyconnectelevationofprivilegesviadmginstallscript.html based ...

Cisco AnyConnect 3.1.08009 - Local Privilege Escalation (via DMG Install Script)

/ Cisco AnyConnect elevation of privileges via DMG install script - proof of concept Yorick Koster, July 2015 https://securify.nl/advisory/SFY20150701/ciscoanyconnectelevationofprivilegesviadmginstallscript.html based on...

CVE-2015-5063

Multiple cross-site scripting XSS vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter to install.php...

MantisBT Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the admin/install.php script in MantisBT versions 1.2.18 and earlier...