WordPress User Role Editor Plugin < 4.25 - Privilege Escalation Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress...

Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities

Summary Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon 2.2.1. mmmagentd commonly runs with root privileges and does not require authentication by default. A specially crafted MMM protocol message can cause a...

PT-2018-10108 · Cksource +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: Liferay versions 6.2.x and earlier Description: The issue concerns an FCKeditor configuration that may allow an attacker to upload or transfer files of potentially dangerous types. These files can be automatically processed within the product...

WordPress Plugin User Role Editor 4.25 - Privilege Escalation

WordPress Plugin User Role Editor 4.25 - Privilege Escalation This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The...

WordPress Plugin User Role Editor < 4.25 - Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress User Role Editor Plugin Privilege Escalation', 'Description' = %q The WordPress User Role Editor plugin prior to v4.25, is lacking an...

TBK DVR4104 DVR4216 - Credentials Leak

TBK DVR4104 DVR4216 - Credentials Leak -- coding: utf-8 -- import json import requests import argparse import tableprint as tp class Colors: BLUE = '\03394m' GREEN = '\03332m' RED = '\0330;31m' DEFAULT = '\0330m' ORANGE = '\03333m' WHITE = '\03397m' BOLD = '\0331m' BRCOLOUR = '\0331;37;40m' banne...

Frog CMS 0.9.5 Cross Site Scripting

Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings Date: 2018-04-23 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/philippe/FrogCMS Software Link: https://github.com/philippe/FrogCMS Version: 0.9.5 Tested on: php 5.6...

SUSE-RU-2018:1071-1 Recommended update for several crowbar barclamps

This update for Crowbar provides several fixes and improvements for the following barclamps: crowbar-openstack: - nova: Use internal placement url bsc1055188 - nova: Subscribe to placement config bsc1055188 - barbican: Add missing roles used in policy.json bsc1081573 - barbican: Add creator role...

Monstra cms 3.0.4 - Persitent Cross-Site Scripting

Monstra cms 3.0.4 - Persitent Cross-Site Scripting Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Date: 2018-04-14 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested o...

Monstra CMS 3.0.4 Cross Site Scripting

Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Date: 2018-04-14 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: php 5.6, apache2.2.29, macos 10.12.6 CVE...

Monstra cms 3.0.4 - Persitent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: php 5.6,...

Monstra cms 3.0.4 - Persitent Cross-Site Scripting

Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Date: 2018-04-14 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: php 5.6, apache2.2.29, macos 10.12.6 CVE...

Design/Logic Flaw

Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur even if the logged-in user has a read-only role...

CVE-2018-10174

The CVE concerns Digital Guardian Management Console 7.1.2.0015 with a server-side request forgery (SSRF) vulnerability. The issue lets remote attackers induce the console to access file:// URLs to read arbitrary files, and to send TCP traffic to intranet hosts or obtain NTLM hashes, even when th...

CVE-2018-0238

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2018-0238

CVE-2018-0238 affects Cisco UCS Director; an attacker can log in with a modified username and valid password to gain visibility into and perform actions on any VM in the end-user portal. Root cause: improper user authentication checks in role-based resource checking; impact includes information d...

CVE-2018-0238

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

Cisco UCS Director Virtual Machine Information Disclosure Vulnerability

Cisco Unified Computing System UCS is a set of unified computing system of the United States Cisco Cisco Company. The system integrates network, computing, and virtualized resources into a single platform through the extensive use of virtualization technology.Cisco Unified Computing System Direct...

Cross site request forgery (csrf)

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role...

CVE-2018-10127

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role...