phpMyAdmin Releases Critical Software Update — Patch Your Sites Now!

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, today released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers. The...

phpMyAdmin Releases Critical Software Update — Patch Your Sites Now!

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, today released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers. The...

Windows DNS Server Heap Overflow Vulnerability

A remote code execution vulnerability exists in Windows Domain Name System DNS servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as D...

Volkswagen Giveaway Scam Peddles Ad Networks

A fake Volkswagen campaign is making its way across social media platforms, luring in victims with promises of a free Volkswagen car giveaway – but instead redirecting them to third-party ad servers. Victims are first sent messages via WhatsApp or Facebook, purporting to be from Volkswagen and...

HPE Windows Firmware Information Disclosure Vulnerability

HPE Windows Firmware is the Windows firmware provided with HP servers. An information disclosure vulnerability exists in HPE Windows Firmware. An attacker could exploit this vulnerability to obtain sensitive information...

Malcom - Malware Communications Analyzer

Malcom is a tool designed to analyze a system's network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when analyzing how certain malware species try to communicate with the outside world. What is Malcom?...

CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary reques...

UBUNTU-CVE-2018-1002105

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary reques...

CVE-2018-7112

The CVE-2018-7112 flaw affects HPE ProLiant servers (Gen9/Gen8, G7, G6) via the Windows firmware installer and related system ROM/iLO components. Root cause: local disclosure of privileged information due to the HPE Windows firmware installer. Remediation: updated firmware installers released in ...

PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery Exploit Author: Javier Olmedo Website: https://www.sidertia.com Google Dork: N/A Vendor: https://www.phpservermonitor.org/ Software Link:...

Design/Logic Flaw

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

Crlf injection

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7830

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7811

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-7831

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

Default credentials

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

Default credentials

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...

CVE-2018-7831

This entry documents CVE-2018-7831, affecting Schneider Electric Modicon embedded web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The vulnerability is an improper neutralization of script-related HTML tags (Basic XSS) that can be exploited by sending a specially crafted URL to a curren...

CVE-2018-7831

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...