Orange Form <= 1.0 - SQL Injection via CSRF

In the plugin, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers...

WordPress Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

Unauthenticated Arbitrary Post Deletion discovered by Francesco Carlucci in WordPress Orange Form versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of December 29, 2021 and is not available for download. This closure is temporary, pending a full review...

Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

The plugin does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure...

400 Banks’ Customers Targeted with Anubis Trojan

Customers of Chase, Wells Fargo, Bank of America and Capital One, along with nearly 400 other financial institutions, are being targeted by a malicious app disguised to look like the official account management platform for French telecom company Orange S.A. Researchers say this is just the...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005 VMware vCenter Server arbitrary file upload...

500,000 Fortinet VPN credentials exposed: Turn off, patch, reset passwords

A threat actor has leaked a list of almost 500,000 Fortinet VPN credentials, stolen from 87,000 vulnerable FortiGate SSL-VPN devices. The breach list provides raw access to organizations in 74 countries, including the USA, India, Taiwan, Italy, France, and Israel, with almost 3,000 US entities...

Exploit for Server-Side Request Forgery in Microsoft

Proxyshell-Scanner nuclei scanner for Proxyshell RCE CVE-2021...

ProxyShell Exploit Chain

Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: ccondon-r7 at August 12, 2021 9:19pm UTC reported: Check out the Rapid7 analysis for details on the exploit chain. Seems like a lot of the PoC implementations so far are using admin mailboxes, but I’d imagine folks...

rConfig <= 3.9.6 Shell Upload Exploit

This Metasploit module allows an attacker with a privileged rConfig account to start a reverse shell due to an arbitrary file upload vulnerability in /lib/crud/vendors.crud.php. This module requires Metasploit: https://metasploit.com/download Current source:...

Takeaways from the Colonial Pipeline Ransomware Attack

If you feel like you’ve read a lot about ransomware in recent months, it’s because these attacks have indeed intensified. In 2020, ransomware attacks surged by 150 percent, with the average payment size increasing by more than 170 percent. Some of the notable victims include United Health Service...

SQL injection vulnerability in the website builder system ca***_sh***.aspx page of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company specializing in Internet branding and Internet marketing. Hangzhou Orange Promise Technology Co., Ltd. building system cash.aspx page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in website builder system ne***.aspx page of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company specializing in Internet branding and Internet marketing. Hangzhou Orange Promise Technology Co., Ltd. station building system ne.aspx page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

SQL injection vulnerability in ab***.aspx page of website building system of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company focusing on Internet branding and online marketing, specializing in the following areas: branded website customization, WeChat application development, e-commerce platform development, mobile application development. Hangzhou Orange Promis...

SQL injection vulnerability in pr***.aspx page of website building system of Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company focusing on Internet branding and online marketing, specializing in the following areas: branded website customization, WeChat application development, e-commerce platform development, mobile application development. There is a SQL injecti...

MobileIron MDM Hessian-Based Java Deserialization RCE

This module exploits an ACL bypass in MobileIron MDM products to execute a Groovy gadget against a Hessian-based Java deserialization endpoint. Module Options msf use exploit/linux/http/mobileironmdmhessianrce msf exploitmobileironmdmhessianrce show targets ...targets... msf...

Command Execution Vulnerability in Orange Light Authoring Tool 2017 (Windows Client)

Orange Light Maker Tool 2017 Edition is a development software for text-based development games. A command execution vulnerability exists in Orange Light Production Tool 2017 Windows client, which can be exploited by an attacker to gain control of the server...

Exploit for Cross-site Scripting in F5 Big-Ip_Access_Policy_Manager

CVE-2020-5902 RCE /tmui/login.jsp/..;/tmui/locallb/workspac...

SQL Injection Vulnerability in Hangzhou Orange Promise Technology Co.

Hangzhou Orange Promise Technology Co., Ltd. is a company focusing on Internet branding and online marketing, specializing in the following areas: branded website customization, WeChat application development, e-commerce platform development, mobile application development. Hangzhou Orange Promis...

Cloud Orange PDF Editor DLL Hijacking Vulnerability

Cloud Orange PDF Editor is a simple and easy to use PDF editing tool of Xunwu Cloud Orange Information Technology Co. Cloud Orange PDF Editor has a DLL hijacking vulnerability, which can be exploited by attackers to execute arbitrary code...

Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Cisco Digital Network Architecture Center 1.3.1.4 - Persistent Cross-Site Scripting Exploit Author: Dylan Garnaud & Benoit Malaboeuf - Pentesters from Orange Cyberdefense France Vendor Homepage:...