Xero: Default.aspx exposing full path and other info on wip.origin-community.xero.com

A Web server Configuration error was reported, which displayed a default installation file with an internal IP address. This was rated low-risk and was fixed in days...

JEECMS XssFilter缺陷导致的存储型XSS漏洞

简要描述： 自带的XssFilter绕过。 详细说明： 在官网下载最新的jeecmsV7 http://.../fabu/41667.jhtml 其中的web.xml中配置了XssFilter如下： XssFilter ...mon.web.XssFilter excludeUrls /member/contribute@/jeeadmin/jeecms@/flowstatistic SplitChar @ FilterChar '@"@@@:@%@ ReplaceChar ‘@“@＼@＃@：@％@＞ 在...mon.web.XssFilter中代码如下： public class...

Uber: Open Redirection on Uber.com

There seems to be an open redirection on Uber.com When a user uses https://www.uber.com//google.com/cities it will lead to a Page Not Found on the Uber website but if the google.com is changed to an IP address such as https://www.uber.com//216.58.217.206/param it will lead to either a 404 or an S...

Agent-XSS

An XSS Channel is an interactive communication channel between two systems which is opened by an XSS attack. At a technical level, it is a type of AJAX application which can obtain commands, send responses back and is able to talk cross-domain. // Exploit Pack server - Change 127.0.0.1 to your IP...

Commands Generated by XenMobile Wizard on NetScaler - SSL Offload

This article will help you when you need to run the wizard more than once for multiple XenMobile environments. This article assumes that you have the following items already installed and configured on the NetScaler: 1. NetScaler IP address NSIP 2. Subnet IP address SNIP 3. DNS Settings 4...

Manage Engine OPutils 8.0 Privilege Escalation

================================================== Privilege escalation Vulnerability in ManageEngine oputils ================================================== . contents:: Table Of Content Overview ======== Title:- Privilege escalation Vulnerability in ManageEngine oputils Author: Kaustubh G...

ManageEngine OPutils 8.0 - Multiple Vulnerabilities

=================================================================================== Privilege escalation Vulnerability in ManageEngine oputils =================================================================================== Overview ======== Title:- Privilege escalation Vulnerability in...

ManageEngine OPutils 8.0 - Multiple Vulnerabilities

ManageEngine OPutils 8.0 - Multiple Vulnerabilities =================================================================================== Privilege escalation Vulnerability in ManageEngine oputils =================================================================================== Overview ========...

Design/Logic Flaw

Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco serve...

Arris DG1670A Cable Modem Remote Command Execution

Vulnerability Details Affected Vendor: Arris Affected Product: Cable Modem Affected Version: DG1670A, TG1670 Platform: Embedded Linux CWE Classification: CWE-73: External Control of File Name or Path; CWE-77: Improper Neutralization of Special Elements used in a Command; CWE-522: Insufficiently...

EXPRESSCLUSTER X vulnerable to directory traversal

Overview EXPRESSCLUSTER X from NEC Corporation is software to provide high availability HA clustering. EXPRESSCLUSTER X contains an issue in WebManager, which may lead to directory traversal. Yusuke SAKAI of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated...

180.222.202.244 XSS vulnerability

Vulnerable URL: http://180.222.202.244/hkm/zh-hk/individual/contact-us-info.html?prodName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

203.157.32.43 XSS vulnerability

Vulnerable URL: http://203.157.32.43/dmsproject/user/search.php?projectname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

The vulnerability of the PMG5318 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the PMG5318 router microprogramming system’s accessibility detection mechanism is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary commands via the PingIPAddr parameter...

Threat Outbreak Alert RuleID20440: Email Messages Distributing Malicious Software on January 14, 2016

Medium Alert ID: 43009 First Published: 2016 January 14 14:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20440 may contain the following files: Name |...

CVE-2015-8333

The Operation and Maintenance Unit OMU in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets...

Design/Logic Flaw

The Operation and Maintenance Unit OMU in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenticated users to change the IP address of the media server via crafted packets...

CVE-2015-8333

The CVE-2015-8333 issue affects Huawei VCN500: the Operation and Maintenance Unit (OMU) before V100R002C00SPC200 allows remote authenticated users to change the media server IP address via crafted packets due to improper user privileges. The Huawei security advisory HWPSIRT-2015-07045 notes this ...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM descriptio...

PHPIPAM 1.1.010 - Multiple Vulnerabilities

PHPIPAM 1.1.010 - Multiple Vulnerabilities Exploit Title: PHPIPAM v1.1.010 Multiple Vulnerabilities Date: 04/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://phpipam.net/ Version: 1.1.010 Category: Multiple Vulnerabilities Tested on : 1.1.010 PHPIPAM description :...