Rubedo CMS 3.4.0 Directory Traversal

Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal Google Dork: intext:rubedo.current.page.description Date: 2018-09-11 Exploit Author: Marouene Boubakri Vendor Homepage: https://www.rubedo-project.org Version: through 3.4.0 Tested on: Linux CVE : CVE-2018-16836 PoC: Read /etc/passwd file from...

Rubedo CMS 3.4.0 - Directory Traversal

Rubedo CMS 3.4.0 - Directory Traversal Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal Google Dork: intext:rubedo.current.page.description Date: 2018-09-11 Exploit Author: Marouene Boubakri Vendor Homepage: https://www.rubedo-project.org Version: through 3.4.0 Tested on: Linux CVE :...

Microsoft Baseline Security Analyzer XML External Entity Injection Vulnerability

Microsoft Baseline Security Analyzer is a security testing program developed by Microsoft that detects vulnerabilities and provides solutions and patch download addresses. Microsoft Baseline Security Analyzer suffers from an XML External Entity Injection vulnerability. The vulnerability could be...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2018-1567)

Summary WebSphere Application Server is shipped with WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Title: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Date: 2018-09-08 Author: John Page aka hyp3rlinx Vendor: Microsoft Software link: https://www.microsoft.com/en-us/download/details.aspx?id=7558...

Microsoft Baseline Security Analyzer 2.3 XML Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-BASELINE-ANALYZER-v2.3-XML-INJECTION.txt + ISR: Apparition Security + Zero Day Initiative Program Vendor www.microsoft.com Product Microsoft Baseline Security...

Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits Title: Microsoft Baseline Security Analyzer 2.3 - XML External Entity Injection Author: John Page aka hyp3rlinx Vendor: Microsoft Software link: https://www.microsoft.com/en-us/download/details.aspx?id=7558 Software Version: 2.3 References:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2018-1695)

Summary WebSphere Application Server is shipped with WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

EyouCms v1.0.8 suffers from information leakage vulnerability

Eyou Content Management System EyouCms is developed by php + mysql a set of open source CMS dedicated to small and medium-sized enterprise website construction. EyouCms v1.0.8 information leakage vulnerability , attackers can use the vulnerability to obtain directory information on a remote serve...

Node.js third-party modules: [knightjs] Path Traversal allows to read content of arbitrary files

I would like to report Path Travelsal in Knightjs It allows attacker to read content of arbitary file on remote server. Module module name: Knightjs version: 0.0.1 npm page: https://www.npmjs.com/package/knightjs Module Description knight is a simple static server without configuration on the top...

UltimatePOS 2.5 Remote Code Execution Vulnerability

Exploit for php platform in category remote exploits Exploit Title: UltimatePOS 2.5 - Remote Code Execution Google Dork: intext:"UltimatePOS" Exploit Author: Renos Nikolaou Vendor Homepage: http://ultimatefosters.com/ Software Link:...

CVE-2003-1605

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server...

CVE-2003-1605

curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server...

Design/Logic Flaw

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

CVE-2018-3833

CVE-2018-3833 affects Insteon Hub (firmware 1013). The firmware upgrade flow fetches signed firmware over plain HTTP and does not verify that the new image is newer than the installed one, enabling an attacker (MITM impersonating cache.insteon.com) to flash older firmware. TALOS research notes mi...

CVE-2018-3833

An exploitable firmware downgrade vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the firmware version that is going to be installed...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server

Summary WebSphere Application Server is shipped with WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Jenkins < 2.121.2 / 2.133 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.133 or is a version of Jenkins LTS prior to 2.121.2. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported versio...

maltrail

Maltrail is a malicious traffic detection system that utilizes publicly available blacklists containing malicious and/or generally suspicious trails. It can detect various types of malicious activity, including domain name, URL, IP address, and HTTP User-Agent header value. Maltrail also uses...

CVE-2018-3834

An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality, triggered via PubNub, retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going t...