PT-2020-15816 · Wso2 · Wso2 Identity Server Analytics +5

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions through 3.1.0 WSO2 API Manager Analytics version 2.5.0 WSO2 IS as Key Manager versions through 5.10.0 WSO2 Identity Server versions through 5.10.0 WSO2 Identity Server Analytics versions through 5.6.0 WSO2 IoT Server...

PT-2020-15814 · Wso2 · Wso2 Identity Server Analytics +8

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions 2.2.0 WSO2 API Manager Analytics versions 2.2.0 WSO2 API Microgateway versions 2.2.0 WSO2 Data Analytics Server versions 3.2.0 WSO2 Enterprise Integrator versions through 6.6.0 WSO2 IS as Key Manager versions 5.5.0...

CVE-2020-24705

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key...

CVE-2020-24705

CVE-2020-24705 describes a session hijacking vulnerability in several WSO2 products where a valid Carbon Management Console session cookie can be sent to an attacker-controlled server after a crafted Try It request. Affected are WSO2 API Manager (through 3.1.0), API Manager Analytics (2.5.0), IS ...

Cross-Site Scripting (XSS)

francoisjacquet/rosariosis is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the URL encode key in PreparePHPSELF.php, leading to an admin session hijacking or executing arbitrary requests using the admin's...

Travel Management System 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Travel Management System v1.0 - SQLi Authentication Bypass Exploit Author: Adeeb Shah @hyd3sec and Bobby Cooke boku Vendor Homepage: https://www.projectsworld.in Software Link:...

MITMf

MITMf is a framework for Man-In-The-Middle attacks. It is a modular and easily extendible tool that aims to provide a one-stop-shop for network attacks. The framework is based on sergio-proxy and has been rewritten from scratch to address the shortcomings of other tools like Ettercap and Mallory...

Debian DSA-4737-1 : xrdp - security update

Ashley Newson discovered that the XRDP sessions manager was susceptible to denial of service. A local attacker can further take advantage of this flaw to impersonate the XRDP sessions manager and capture any user credentials that are submitted to XRDP, approve or reject arbitrary login credential...

Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM)(CVE-2019-12418, CVE-2019-17563)

Summary Multiple vulnerabilities in Open Source Apache Tomcat reported by The Apache Software Foundation affect IBM Tivoli Application Dependency Discovery Manager Vulnerability Details CVEID: CVE-2019-12418 DESCRIPTION: Apache Tomcat could allow a local attacker to gain elevated privileges on th...

TYPO3 8.x < 8.7.25 / 9.x < 9.5.6 Multiple Vulnerabilities

The version of TYPO3 installed on the remote host is 8.x prior to 8.7.25 or 9.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists in Typo3's image processing functionality due to a failure to properly configure applications it...

Code injection

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects OTRS Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and...

CVE-2020-14485

OpenClinic GA CVE-2020-14485 affects OpenClinic GA versions 5.09.02 and 5.89.05b. The issue is an authentication bypass using an alternate path or channel that may allow a session with limited functionality and execution of admin functions such as SQL queries. ICS advisories indicate this vulnera...

TYPO3 8.5.x < 8.7.27 / 9.x < 9.5.8 Session Hijacking (TYPO3-CORE-SA-2019-018)

The version of TYPO3 installed on the remote host is 8.5.x prior to 8.7.27 or 9.x prior to 9.5.8. It is, therefore, affected by a session hijacking vulnerability due to a failure to properly clean up user sessions. When a user logs out their session is transferred to that of the anonymous user. A...

Online Polling System 1.0 - Authentication Bypass

Exploit Title: Online Polling System 1.0 - Authentication Bypass Date: 2020-07-20 Author: AppleBois Version: NULL Software Link: https://www.sourcecodester.com/php/14330/online-polling-system.html Administration Control Panel || Authentication Bypass Unthenticated User perform SQL Injection bypas...

Siemens SICAM MMU, SGU and T Cross-Site Scripting Vulnerabilities

SICAM T is a digital measurement sensor that allows the measurement of power in the non-electrical network in a single unit.ICAM-MMU Measurement and Monitoring Unit is a power monitoring unit that allows the measurement of power in the grid in a single unit.SICAM SGU Discontinued is a Smart Grid...

Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass

Exploit Title: Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass Date: 2020-07-03 Exploit Author: KeopssGroup0day,Inc Vendor Homepage: https://github.com/mrzulkarnine/Web-based-hotel-booking-system Software Link: https://github.com/mrzulkarnine/Web-based-hotel- booking-system...

U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

CVE-2020-7576

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2, Opcenter Execution Core V8.2. An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting XSS attacks...

CVE-2020-10041

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. A stored Cross-Site-Scripting XSS vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user...

Cross site scripting

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2, Opcenter Execution Core V8.2. An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting XSS attacks...