CVE-2018-18949

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings...

CVE-2018-18949

CVE-2018-18949 affects Zoho ManageEngine OpManager 12.3 prior to build 123222. The vulnerability is a SQL injection via Mail Server settings caused by insufficient validation of the mailservername, enabling an attacker to breach the database security context. Impact is described as high/critical ...

CVE-2018-18949

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings...

JVN#95589314: Joruri Gw vulnerable to arbitrary file upload

Joruri Gw provided by SiteBridge Inc. is groupware which runs on Ruby on Rails. Joruri Gw contains a vulnerability that may allow an attacker to upload arbitrary files CWE-434. Impact A user may upload arbitrary files. When PHP code execution is enabled on the server, a user may execute arbitrary...

Cisco WebEx Meetings Server Elevation of Privilege Vulnerability

Cisco WebEx Meetings Server CWMS is the United States Cisco Cisco WebEx meeting program in a set of multifunctional meeting solutions that include audio, video and Web conferencing. An elevation of privilege vulnerability exists in Cisco WebEx Meetings Server that stems from the program's inabili...

XenMobile Policy State Pending or Failed on Windows Devices

This purpose of this article is to help XenMobile administrator troubleshoot issues related to windows policy deployment failures and also provide additional information on settings up XenMobile server with right values...

ISSUE: Policy state pending or failed for Android devices

This purpose of this article is to help Xenmobile administrator troubleshoot issues related to Android policy deployment failures and also provide additional information on settings up XMS server with right values...

Nextcloud: The email API to test email-server settings is unlimited and can be used as a email bomb

Description: The email-server settings test function in https://demo.nextcloud.com/xxx/settings/admin/additional is unlimited and can be used as a email bomb. And the test email API is https://demo.nextcloud.com/xxx/settings/admin/mailtest Reproduce steps: 1.Go to...

Openfire 3.10.2 - Cross-Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt Vendor: ================================ www.igniterealtime.org/projects/openfire www.igniterealtime.org/downloads/index.jsp Product: ================================...

Stash email settings fields can be inadvertently be populated by browser with user login details - security issue

The email and username password in the email server settings screen has the same names as the username and password fields when logging in. This has the unintentional side affect of being pre-populated by your browser if you have left the mail server credentials blank and your browser has saved...

EmuLive Server4 Authentication Bypass And Denial of Service Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/11226/info Reportedly EmuLive Server4 is affected by an authentication bypass vulnerability and a denial of service vulnerability. These issues are due to an access validation issue and a failure to handle exceptional...

Ian Dunn: PHP and Wordpress version disclosure

Vulnerable File google-authenticator-per-user-prompt/views/requirements-error.php Description That file discloses the PHP version and Wordpress version to the world.Which is not a bug actually,but these information can be helpful to demonstrate further devastating bugs. Suggestion I saw that you...

Apache settings are not strict, the exposed server-status-vulnerability warning-the black bar safety net

1 0 month 3 0 day, foreign security researchers found that because of the apache settings are not strict, causes the server state is exposed to the public network. Originally, the apache has one called server-status function, for the convenience of the administrator to check the server running...

Patch Management: IBM Tivoli Endpoint Manager Server Settings

Binary data ibmtemsoapsettings.nbin...

Sysax 5.60 - Create SSL Certificate Buffer Overflow

Sysax 5.60 - Create SSL Certificate Buffer Overflow Title: Sysax Security Settings Configure - Create Certificate - You will get an error, click OK and voila, code execution calc.exe shell32.ll jmp esp 7cb97475...

Sysax <= 5.60 Create SSL Certificate Buffer Overflow

Exploit for windows platform in category local exploits Title: Sysax Security Settings Configure - Create Certificate - You will get an error, click OK and voila, code execution calc.exe shell32.ll jmp esp 7cb97475...

Patch Management: SCCM Server Settings

Binary data sccminitinfo.nbin...

Patch Management: VMware Go Server Settings (deprecated)

This script initializes the VMware Go server credentials as set by the user. To set the credentials, edit your scan policy and go to the section 'Preferences'. This does not connect to the target host. This plugin has been deprecated. VMware Go and VMware Go Pro reached End of Support Life on Mar...

phpMyAdmin &lt;= 2.6.1 disclosure ways

=================================== phpMyAdmin = 2.6.1 disclosure ways =================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0 ////// // // // // // 1 1 / Exploi...

Changing system locale means users with non-ASCII characters in their passwords cannot authenticate

The OSUser and Atlassian-User authenticators used by Confluence convert a password into bytes before hashing it. This conversion doesn't specify which encoding should be used, so the system's default encoding is used. If the system administrator changes the locale settings on the server or change...