Design/Logic Flaw

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in Open Whisper Signal 1.10.1 and earlier versions, which stems from the program failing to filter HTML elements. A remote attacker can exploit the vulnerability by sendi...

SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion Vulnerability

Exploit for linux platform in category web applications Title: SAP B2B / B2C CRM 2.x 4.x - Local File Inclusion Application:SAP B2B OR B2C is CRM Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 to icssb2b Vendor URL: http://SAP.com Bugs: SAP LFI in B2B OR B2C CRM Sent:...

Sql injection

interface\super\editlist.php in OpenEMR before v5011 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter...

SAP B2B / B2C CRM Local File Inclusion

Title: SAP B2B / B2C CRM 2.x 4.x - Local File Inclusion Application:SAP B2B OR B2C is CRM Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 to icssb2b Vendor URL: http://SAP.com Bugs: SAP LFI in B2B OR B2C CRM Sent: 2018-05-03 Reported: 2018-05-03 Date of Public Advisory:...

Advantech WebAccess Node webvrpcs drawsrv Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x277f IOCTL in the webvrpcs process. The issue...

SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

Title: SAP B2B / B2C CRM 2.x 4.x - Local File Inclusion Application:SAP B2B OR B2C is CRM Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 to icssb2b Vendor URL: http://SAP.com Bugs: SAP LFI in B2B OR B2C CRM Sent: 2018-05-03 Reported: 2018-05-03 Date of Public Advisory:...

SAP B2B B2C CRM 2.x 4.x - Local File Inclusion

SAP B2B B2C CRM 2.x 4.x - Local File Inclusion Title: SAP B2B / B2C CRM 2.x 4.x - Local File Inclusion Application:SAP B2B OR B2C is CRM Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 to icssb2b Vendor URL: http://SAP.com Bugs: SAP LFI in B2B OR B2C CRM Sent: 2018-05-03...

Advantech WebAccess Node notify2 pw Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within notify2.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process...

Advantech WebAccess Node bwtagblk Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwtagblk.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs proces...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9954

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9954 due to a flaw in handling XFA Button elements. The bug occurs when setting the y attribute, where the code does not properly validate the existence of an object before operating on it, enabling remote code execution under the process context. E...

Malicious Package

Overview The getcookies module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. Recommendation This module should be uninstalled if found used within an application. In addition to removing the installed module,...

CVE-2018-11091

An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the...

CVE-2018-8914

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...

Microsoft ChakraCore and Edge Remote Code Execution Vulnerability (CNVD-2018-10207)

Microsoft Windows 10 is a suite of operating systems from Microsoft Corporation.Edge is one of the default browsers that comes with the system.ChakraCore is the core of an open source JavaScript engine used in Edge, and is also available as a standalone JavaScript engine.... A remote code executi...

Windows VBScript Engine Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerabili...

Authentication Bypass allows alarm's commands execution in iSmartAlarm(CVE-2017-7728)

Vendor: iSmartAlarm, inc. Product: iSmartAlarm cube - All iSmartAlarm is one of the leading IoT manufactures in the domain of smart alarm systems. It provides a fully integrated alarm system with siren, smart cameras and locks. It functions like any alarm system, but with the benefits of a...

FTPShell Client 6.7 - Buffer Overflow

-- coding: utf-8 -- Exploit Title: FTPShell Client 6.7 - Remote Buffer Overflow Date: 2018-01-03 Exploit Author: Sebastián Castro @r4wd3r Vendor Homepage: http://www.ftpshell.com/index.htm Software Link: http://www.ftpshell.com/download.htm Version: 6.7 Tested on: Windows Server 2008 R2 x64,...