2017 matches found
CVE-2019-14894
CVE-2019-14894 affects the CloudForms Management Engine, specifically versions 5.10 and 5.11. The flaw enables remote code execution through the NFS schedule backup mechanism. An attacker who can log into the management console could execute arbitrary shell commands on the CloudForms server with ...
CVE-2019-14894: Improper Input Validation
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms...
entrelherbeetlevent.fr Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1158738 Security Researcher cvesh Helped patch 9 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting entrelherbeetlevent.fr website and its users. Following coordinated and responsible vulnerability disclosure guidelines of t...
nilandco.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1156306 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting nilandco.com website and...
regmarkets.ru Open Redirect vulnerability
Open Bug Bounty ID: OBB-1152487 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting regmarkets.ru website an...
Malicious Package
Overview 3months-staff-schedule is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
Citrix Hypervisor Multiple Security Updates
Description of Problem Several issues have been identified within Citrix Hypervisor, which could, if exploited, allow: privileged code in a PV guest VM to read a single uninitialized 4kB page of memory that may contain data left by a previous VM privileged code in a guest VM to cause the host to...
nekkyo-singapore.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1137943 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting nekkyo-singapore.com...
biblioteca.ivic.gob.ve Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1135536 Security Researcher Gh05tPT Helped patch 6878 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting biblioteca.ivic.gob.ve...
hurtowniamuzyczna.pl Cross Site Scripting vulnerability
Security Researcher shafiqueWasta Helped patch 28 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting hurtowniamuzyczna.pl website and its users. Following coordinated and responsible...
Emerging APT Mounts Mass iPhone Surveillance Campaign
A recently discovered, mass-targeted watering-hole campaign has been aiming at Apple iPhone users in Hong Kong – infecting website visitors with a newly developed custom surveillance malware. The bad code – the work of a new APT called “TwoSail Junk” – is delivered via a multistage exploit chain...
Command injection
Vesta Control Panel VestaCP through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bashlogout to a .bashlogout' substring followed by shell...
CVE-2020-10808
CVE-2020-10808 affects Vesta Control Panel (VestaCP) up to version 0.9.8-26. It describes a command injection vulnerability in the schedule/backup Backup Listing Endpoint. The attacker must create a crafted filename on the server, demonstrated via an FTP session that renames a file (e.g., .bash_l...
CVE-2020-10808: Improper Neutralization of Special Elements used in an OS Command
Vesta Control Panel VestaCP through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bashlogout to a .bashlogout' substring followed by shell...
CloudForms: RCE vulnerability in NFS schedule backup
A flaw was found in the CloudForms management engine, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root...
Important: Red Hat Security Advisory: CloudForms 4.7.15 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
Important: Red Hat Security Advisory: CloudForms 5.0.3 security update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
CVE-2019-14894
A flaw was found in the CloudForms management engine, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root...
Cuckoo Clock v5.0 - Buffer Overflow
Exploit Title: Cuckoo Clock 5.0 - Buffer Overflow Exploit Author: boku Date: 2020-02-14 Vendor Homepage: https://en.softonic.com/author/pxcompany Software Link: https://en.softonic.com/download/parallaxis-cuckoo-clock/windows/post-download Version: 5.0 Tested On: Windows 10 32-bit Recreate: 1...
