Design/Logic Flaw

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...

CVE-2020-8154

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...

WebTareas 2.0p8 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WebTareas v2.0p8 - Login Portal - Reflected Cross Site Scripting XSS Exploit Author: Bobby Cooke Vendor Homepage: http://webtareas.sf.net/ Software Link:...

Online Scheduling System 1.0 - Authentication Bypass

Exploit Title: Online Scheduling System 1.0 - Authentication Bypass Exploit Author: Bobby Cooke Date: 2020-04-30 Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html Software Link:...

Online Scheduling System 1.0 - Persistent Cross-Site Scripting

Exploit Title: Online Scheduling System 1.0 - Persistent Cross-Site Scripting Exploit Author: Bobby Cooke Date: 2020-04-30 Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html Software Link:...

Remote Code Execution

sonatype nxrm is vulnerable to remote code execution. The EL expression engine to process EL expressions is not wrapped by the standard delimiters $, allowing an attacker with any type of account on NXRM to execute arbitrary code by crafting a malicious request to NXRM...

Sonatype Nexus Repository Manager Command Execution Vulnerability (CNVD-2020-28477)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute arbitrary code with the help of a malicious request...

Cross site request forgery (csrf)

A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious managefiles.cgi request. This can be triggered via XSS or an IFRAME tag included within the site...

Cacti 1.2.8 - Authenticated Remote Code Execution Exploit

Exploit for multiple platform in category web applications !/usr/bin/python3 Exploit Title: Cacti v1.2.8 Remote Code Execution Exploit Author: Askar @mohammadaskar2 CVE: CVE-2020-8813 Vendor Homepage: https://cacti.net/ Version: v1.2.8 Tested on: CentOS 7.3 / PHP 7.1.33 import requests import sys...

CVE-2020-3147 Cisco Small Business Switches Denial of Service Vulnerability

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this...

Remote Code Execution (RCE)

Microsoft aspnetcore is vulnerable to remote code execution RCE. The attack is possible because objects in memory were not handled properly, allowing a remote attacker to send malicious request to trigger a code execution remotely...

Arbitrary File Read Vulnerability in ZTE ZSRV2 Series Multiservice Routers

ZXR10 ZSR V2 series router is a next-generation intelligent access router product integrating routing, switching, wireless, security, VPN, and AC launched by ZTE. The product adopts the industry-leading hardware platform and software architecture, which provides an intelligent and resilient devic...

Arbitrary File Read Vulnerability in ZTE ZXR10 1800-2S Router

The ZTE ZXR10 1800-2S Router is a multi-service intelligent router manufactured by ZTE Corporation. An arbitrary file read vulnerability exists in the ZTE ZXR10 1800-2S router, which can be exploited by an attacker to access arbitrary files by sending a malicious request...

Cisco IOS XE Software REST API Authorization Bypass (cisco-sa-20180328-rest)

According to its self-reported version, Cisco IOS XE Software is affected by an authorization bypass vulnerability in the REST API due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An authenticated, remote attacker can exploit this, by...

Design/Logic Flaw

A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due t...

Cross-Site Request Forgery (CSRF)

Bolt is vulnerable to cross-site request forgery CSRF. It allows an attacker to trick an authenticated user to submit a malicious request to execute action on behalf of the attacker...

CVE-2019-6651

In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request...

CVE-2019-6651

In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request...

F5 Networks BIG-IP : REST Framework vulnerability (K89509323)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5 / 12.1.5 / 13.1.3 / 14.0.1 / 14.1.2 / 15.0.1 / 15.1.0. It is, therefore, affected by a vulnerability as referenced in the K89509323 advisory. The BIG-IP/BIG-IQ Configuration utility login page may not follow best...

Cisco Small Business 220 Series Smart Switches Buffer Overflow Vulnerability

Cisco Small Business 220 Series Smart Switches is a small smart switch device from Cisco USA. A buffer overflow vulnerability exists in Cisco Small Business 220 Series Smart Switches. An attacker can exploit this vulnerability by sending a malicious request to execute arbitrary code with root...