UBUNTU-CVE-2017-5661

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full...

Jackson Framework enableDefaultTyping method deserialization vulnerability

Jackson is an open source java serialization and deserialization tools , you can serialize java objects into xml and json format strings or two kinds of files deserialized into the corresponding object . Jackson framework enableDefaultTyping method there is a Java deserialization code execution...

WebDAV

Web Distributed Authoring and Versioning WebDAV is a facility that enables basic file management reading and writing to a web server. It essentially allows the webserver to be mounted by the client as a traditional file system allowing users a very simplistic means to access it as they would any...

Code Injection

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages such as those that run in the browser -- like JavaScript and server-side languages which are executed by the server -- like ASP,...

Backdoor Detection

The scanner was able to determine that a possible web backdoor or web shell exists on the remote web server by utilizing the same methods as cyber-criminals. If a server has been previously compromised, there is a high probability that the cyber-criminal has installed a backdoor so that they can...

Publicly writable directory

There are various methods in which a file or files may be uploaded to a webserver. One method that can be used is the HTTP PUT method. The PUT method is mainly used during development of applications and allows developers to upload or put files on the server within the web root. By nature of the...

Critical Moodle Vulnerability Could Lead to Server Compromise

A critical vulnerability in Moodle, an open source PHP-based learning management system deployed across scores of schools and universities, could expose the server its running on to compromise. Tens of thousands of universities worldwide, including the California State University system, the...

Bull / IBM AIX Clusterwatch/Watchware - Multiple Vulnerabilities

Exploit for cgi platform in category web applications Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries and we...

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries...

CVE-2016-3127

An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain...

CVE-2016-3127

An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain...

Arbitrary File Upload Vulnerability in eWebEditor Editor of Fuzhou Extreme Software Development Co.

Fuzhou Extreme Software Development Co. eWebEditor editor is a browser-based online HTML editor. An arbitrary file upload vulnerability exists in the eWebEditor editor of Fuzhou Extreme Software Development Co. Due to logging into the backend via anonymous access or weak account/password...

132 Google Play Apps Booted For Having Malicious IFrames

Google removed 132 apps infected with malicious iFrames from its Google Play store after security researchers discovered a development platform used to create the apps was infected with malware and in turn compromised the apps. Palo Alto Networks’ Unit 42 researchers said the apps were infected...

CVE-2016-8931

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server...

WordPress CM Download Manager Code Injection (CVE-2014-8877)

Content Management Download Manager for WordPress is prone to remote PHP-code execution vulnerability because it fails to validate user input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. This may aid in further attacks or lead to a full...

CVE-2017-3273

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DDL. Supported versions that are affected are 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2017-3313

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: MyISAM. Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure wher...

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

A security researcher recently reported a critical vulnerability in one of the most popular open source PHP libraries used to send emails that allowed a remote attacker to execute arbitrary code in the context of the web server and compromise a web application. Disclosed by Polish security...

SQL Injection Vulnerability in Shenzhen Siquan CRM System

Ltd. is engaged in OA, CRM, ERP, HRM, enterprise mailbox system consulting and services. A SQL injection vulnerability exists in Shenzhen SiQuan CRM system. The lack of filtering of the 'username' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

Arbitrary File Upload Vulnerability in ucms

UCMS is an open source content management system that can be used to develop a variety of various enterprise stations, article stations and station systems. ucms background file management system file upload vulnerability. As the program does not judge the upload file, allowing attackers to explo...