CVE-2020-12447

A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Date: 2020-03-26 Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version:...

CVE-2020-8540

An XML external entity XXE vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2018-20687

An XML external entity XXE vulnerability in CommandCenterWebServices/.?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2019-9569

Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors...

Buffer overflow

Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors...

CVE-2019-9569

Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

GrandNode 4.40 - Path Traversal / Arbitrary File Download Vulnerabilities

Exploit for multiple platform in category web applications Exploit Title: GrandNode Path Traversal & Arbitrary File Download Unauthenticated Exploit Author: Corey Robinson https://twitter.com/CRobSec Vendor Homepage: https://grandnode.com/ Software Link:...

GrandNode 4.40 - Path Traversal / Arbitrary File Download

Exploit Title: GrandNode Path Traversal & Arbitrary File Download Unauthenticated Date: 06/23/3019 Exploit Author: Corey Robinson https://twitter.com/CRobSec Vendor Homepage: https://grandnode.com/ Software Link:...

CVE-2019-3599 McAfee Agent update fixes an Information Disclosure vulnerability

Information Disclosure vulnerability in Remote logging which is disabled by default in McAfee Agent MA 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled...

CVE-2019-3598

CVE-2019-3598 affects McAfee Agent (MA) 5.x where a bug in how UDP requests are processed leads to a denial of service when handling specially crafted UDP packets. The vulnerability allows remote, unauthenticated attackers to potentially cause the MA service to stop responding, reducing availabil...

CVE-2018-0061

A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to...

CVE-2018-0061 Junos OS: Denial of service in telnetd

A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to...

WordPress Chained Quiz 1.0.8 Plugin - answer SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Çlirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version:...

WordPress Chained Quiz 1.0.8 SQL Injection

Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Alirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version: 1.0.9 CVE : N/A WPVULNDB:...

Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection

Details ================ Software: Fortify SSC Software Security Center Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-12463 CVE: CVE-2018-12463 at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12463 CVSS: HIGH...

CVE-2018-12463

An XML external entity XXE vulnerability in Fortify Software Security Center SSC, version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Cross site scripting

An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...