CVE-2018-0322

A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning PCP could allow an authenticated, remote attacker to modify sensitive data that is associated with arbitrary accounts on an affected device. The vulnerability is due to a failure to enforce access restrictio...

Cisco Unified Computing System (UCS) Software Input Validation Vulnerability

Cisco Unified Computing System UCS Software is a set of unified computing system of the United States Cisco Cisco. The system through the extensive use of virtualization technology will be integrated into a platform of network, computing and virtualization resources. An input validation...

Cisco Prime Collaboration Provisioning Access Control Bypass Vulnerability (CNVD-2018-11307)

Cisco Prime Collaboration Provisioning PCP is a reliable and scalable Web-based provisioning solution for managing your company's critical next-generation communications services. An access control bypass vulnerability exists in the web interface of Cisco Prime Collaboration Provisioning PCP. The...

Cisco Prime Collaboration Provisioning Access Control Vulnerability

Cisco Prime Collaboration Provisioning PCP is a set of Web-based, next-generation communications services software from Cisco. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A privilege-granting and access control...

Cisco Unified Computing System Role-Based Access Vulnerability

A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System UCS Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation...

Qualys Cloud Platform 2.33 New Features

This release of the Qualys Cloud Platform version 2.33 includes the release for CertView, plus updates and new features for AssetView, Cloud Agent, EC2 Connector, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. This posting has bee...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

Cross site request forgery (csrf)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

PbootCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-12919)

PbootCMS is an open source enterprise building content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in the apps/admin/controller/system/RoleController.php file in PbootCMS version 1.0.7. A remote attacker can exploit this vulnerability ...

CVE-2018-11018

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...

Multiple vulnerabilities in WordPress plugin "Ultimate Member"

Overview The WordPress plugin "Ultimate Member" provided by Ultimate Member contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2018-0585 Directory Traversal in the shortcodes function CWE-22 - CVE-2018-0586 Arbitrary File Upload CWE-434 - CVE-2018-0587 Directory...

phpVirtualBox 5.2 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications Title: phpVirtualBox / CSRF - Stored XSS Discovered by: @codexlynx Software Version: //lib/ajax.php" name="csrf" " / 2Stored XSS -------------------------------- Many fields don't sanitize inputs. This vulnerability could allow a user role...

SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2018-027

This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create...

CVE-2018-10795

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

Design/Logic Flaw

DISPUTED Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

CVE-2018-10795

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

CVE-2018-10795

Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or...

WordPress User Role Editor Plugin Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress User Role Editor plugin prior to v4.25, is lacking an...