Master IP CAM 01 3.3.4.2103 - Remote Command Execution

Master IP CAM 01 3.3.4.2103 - Remote Command Execution Exploit Title: Master IP CAM 01 Remote Command Execution Date: 09-02-2019 Remote: Yes Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: Master IP CAM Version: 3.3.4.2103 CVE: CVE-2019-8387 import sys import reques...

Master IP CAM 01 3.3.4.2103 Remote Command Execution

Exploit Title: Master IP CAM 01 Remote Command Execution Date: 09-02-2019 Remote: Yes Exploit Authors: Raffaele Sabato Contact: https://twitter.com/syrion89 Vendor: Master IP CAM Version: 3.3.4.2103 CVE: CVE-2019-8387 import sys import requests if lensys.argv " print "- Example: python...

Security feature bypass

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkin...

WordPress Quiz And Survey Master 6.0.4 Cross Site Scripting

Vulnerability: XSS Affected Software: Quiz And Survey Master Affected Version: 6.0.4 Patched Version: none CVE: not requested Risk: Medium Vendor Contacted: 10/25/2018 Vendor Fix: none Public Disclosure: 02/05/2019 Credit: Tim Coen CVSS 6.1 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

Quiz And Survey Master < 6.2.2 - Authenticated Cross-Site Scripting (XSS)

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://example.com/wp-admin/admin.php?page=mlwquizresultsid=%27%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E...

Quiz And Survey Master < 6.2.2 - Authenticated Cross-Site Scripting (XSS)

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. http://example.com/wp-admin/admin.php?page=mlwquizresults&quizid=%27%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E...

Mozilla Thunderbird < 60.2.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-25 advisory. - A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by...

CloudBees Script Security Plugin Remote Code Execution Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Script Security is one of the plug-ins used to detect the script security . A...

Unspecified Vulnerability in CloudBees Pipeline Groovy Plugin

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor order repetitive work.Pipeline:Groovy Plugin is one of the process build plugins in the Java-based continuous integration tools. . An unspecified...

Security feature bypass

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP...

Security feature bypass

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM...

CVE-2019-1003002

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP...

CVE-2019-1003000

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM...

CVE-2019-1003002

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP...

CVE-2019-1003000

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM...

CVE-2019-1003000

CVE-2019-1003000 is a sandbox bypass/remote code execution flaw in Jenkins via the Script Security Plugin (and depending on Groovy/Declarative plugins). Affected components include Script Security Plugin versions up to 1.49 and earlier, with vulnerable code in GroovySandbox.java that lets attacke...

Jargon Watch: Stochastic Terrorism Lets Bullies Operate in Plain Sight

It takes a master demagogue to weaponize unstable individuals and aim them at political enemies...

Information Disclosure

Mozilla Firefox is vulnerable to information disclosure. Setting a master password does not delete unencrypted passwords that were previously stored, allowing other users to retrieve the stored password data...

Authorization Bypass

ceph is vulnerable to authorization bypass attacks. The vulnerability exists as a flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, lumino...

Jenkins path traversal vulnerability (CNVD-2019-01085)

CloudBees Jenkins formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor continuous software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins a long-ter...