Hoosk CMS 安全漏洞

Hoosk is a lightweight user-centric content management system CMS with a built-in Codelgniter for creating responsive websites. The system has a built-in Codelgniter for creating responsive websites. An unspecified vulnerability in /install/index.php in Hoosk version 1.8.0 stems from the program'...

CVE-2020-28899

The Web CGI Script on ZyXEL LTE4506-M606 V1.00ABDO.2C0 devices does not require authentication, which allows remote unauthenticated attackers via crafted JSON action data to /cgi-bin/gui.cgi to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi...

pcp: Local privilege escalation in pcp spec file %post section

A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Developmen...

CVE-2020-1984

Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with ‘create folders or append data’ access to the root of the OS disk C: to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo f...

Indexhibit Reinstallation Vulnerability

Indexhibit is a content management system CMS. A security vulnerability exists in Indexhibit version 2.1.5. The vulnerability can be exploited by an attacker to execute code via /ndxzstudio/install.php?p=2...

CVE-2016-10807

cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost SEC-112...

CVE-2017-7642

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable...

SolarWinds Log and Event Manager Local Elevation of Privilege Vulnerability

SolarWinds Log and Event Manager LEM, a.k.a. SIEM is a log and event manager from the U.S.-based SolarWinds that provides real-time log analysis, memory event correlation, and threat attack response. A local elevation of privilege vulnerability exists in SolarWinds Log and Event Manager versions...

chromium-browser: Parameter sanitization failure in DevTools

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

Google Chrome DevTools Access Restriction Vulnerability (CNVD-2016-06145)

Google Chrome is a web browsing tool developed by Google. Google Chrome has a security vulnerability. Due to incorrectly handling the hostname of a script path, it allows remote attackers to bypass intended access restrictions via URLs. Different from cve-2016-5144...

Gonafish LinksCaffe Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in Gonafish LinksCaffe due to a lack of required authentication for the application's admin script. Allowing an attacker to simply use the admin function by knowing the name and location of the script...

Fantastic News <= 2.1.2 (script_path) Remote Code Execution Exploit

No description provided by source...

DieselScripts Job Site Forgot.PHP Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/19622/info Multiple cross-site scripting vulnerabilities affect Job Site because the application fails to properly sanitize user-supplied input before including it in dynamically generated web content. An attacker may...

DieselScripts DieselPay Index.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19623/info DieselPay is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of ...

Traidnt up 2.0 - (Cookie) Add Extension Bypass Exploit

No description provided by source. html center br br !-- Traidnt Up version 2.0 Add Extension By Pass Author: SP4rT Email : [email protected] DownLoad : http://traidnt.net/vb/showthread.php?t=943260 Downloads : 33712 1. Enter uploadcp url 2. javascript:documentcookie=trupuser=SP4rT;; 3. Enter this...

UBUNTU-CVE-2013-4555

Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...

Ultimate Uploader 1.3 - Arbitrary File Upload

Ultimate Uploader 1.3 - Arbitrary File Upload ========================================================================== Script Name : Ultimate Uploader 1.3 Language : php Vendor : http://www.element-it.com Author : Master Mind Home : www.shdowskill.com , www.vbspiders.com...

phUploader Shell Upload

========================================================================== Script Name : phUploader Language : php email: [email protected] ============================================================ Dork : Powered By phUploader ============================================================ Exploit ...

PHPhotoalbum Shell Upload

========================================================================== Script Name : PHPhotoalbum Language : php email: [email protected] ============================================================ Dork : Powered By PHPhotoalbum or inurl:"PHPhotoalbum-upload.php"...

phUploader 2 - Arbitrary File Upload

phUploader 2 - Arbitrary File Upload Exploit Title: phUploader Remote File Upload Vulnerability Date: 20-12-2009 Author: wlhaan-hacker Version: v2 CVE : N/A ========================================================================== Script Name : phUploader Language : php email: [email protected]...