10025 matches found
CVE-2013-7377
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe...
PT-2017-5748
Name of the Vulnerable Software and Affected Versions: codem-transcode module versions prior to 0.5.0 Description: The issue allows remote attackers to execute arbitrary commands via a POST request to "/probe" when ffprobe is enabled. This is possible because HTTP POST requests to "/probe" are...
Directory traversal
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request...
CVE-2017-9367
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request...
CVE-2017-9367
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request...
PT-2017-18878
Name of the Vulnerable Software and Affected Versions BlackBerry Workspaces Server affected versions not specified Description A directory traversal issue could allow an attacker to execute, upload, or reveal arbitrary files on the web server by manipulating a URL in a POST request. Recommendatio...
Flexense VX Search Enterprise Buffer Overflow Vulnerability
Flexense VX Search Enterprise is an automated rules-based document search solution from Flexense Canada. A buffer overflow vulnerability exists in Flexense VX Search Enterprise version 10.1.12. A remote attacker could exploit the vulnerability by sending a buffer overflow to a file that begins wi...
CVE-2017-9367: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request...
CVE-2017-15220: Improper Restriction of Operations within the Bounds of a Memory Buffer
Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code...
PT-2017-13916
Name of the Vulnerable Software and Affected Versions Flexense VX Search Enterprise version 10.1.12 Description The issue allows remote attackers to execute arbitrary code via a buffer overflow. This is achieved by sending an empty POST request to a long URI that begins with a /../ substring...
HP UCMDB Server BeanUtils Java Deserialization RCE
The HP Universal Configuration Management Database UCMDB Server running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons BeanUtils library. An unauthenticated, remote attacker can exploit...
Instacart: Get all instacart emails - missing rate limit on /accounts/register
Hey Instacart team, When signing up for an account, you enter your email. When this email is already in use, the server responds with ""errors":"email":"has already been taken"" This in not a problem, but the fact that you could send this request unlimited times is the issue. This way we can easi...
Lansweeper 6.0.100.29 XXE Injection
============================================= - Release date: October 06th, 2017 - Discovered by: BarkA+-n KA+-lA+-ASS, Mehmet Dursun Adegnce - Severity: High ============================================= I. VULNERABILITY ------------------------- Lansweeper XXE vulnerability. II. INTRODUCTION...
Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow
Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow Exploit Title: SyncBreeze POST username overflow Date: 30-Sep-2017 Exploit Author: Owais Mehtab Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.0.28.exe Version: 10.0.28 Tested...
FIBARO Home Center 2/Lite RCE Vulnerability
FIBARO Home Center 2/Lite are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability(CVE-2016-8027)
Summary An exploitable blind sql injection vulnerability exists within McAfee's ePolicy Orchestrator 5.3.0 that is accessible without authentication. A specially crafted HTTP post can allow an aggressor to alter a sql query which can result in disclosure of information within the database or...
GitLab: [Markdown] Stored XSS via character encoding parser bypass
Hi @briann and team, A carefully crafted injection used against the Markdown input parser can be leveraged to store and execute arbitrary JavaScript on GitLab 10.0 hosts. Given the nature of this injection, which makes use of a rather esoteric filter bypass, the scope for exploitation may vary...
Student Result or Employee Database <= 1.6.3 - Auth Bypass
The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...