perfact::mpa Insecure Direct Object Reference

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-072 Products: perfact::mpa Manufacturer: PerFact Innovation GmbH & Co. KG Affected Versions: Custom versions using PerFact DBUtils Toolkit v3.2 Tested Versions: Custom version with PerFact DBUtils Toolkit v3.2 Vulnerability...

Fedora Update for botan FEDORA-2016-1

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Plugin More Fields 2.1 - Cross-Site Request Forgery

Exploit Title: Wordpress More Fields Plugin 2.1 Cross-Site Request Forgery Date: 28-02-2016 Software Link: https://wordpress.org/support/plugin/more-fields Exploit Author: Aatif Shahdad Twitter: https://twitter.com/61617469665f736 Contact: [email protected] Category: webapps 1. Description...

Centreon 2.5.3 Code Execution

Unauthenticated Remote Command Execution in Centreon Web Interface ================================================================== Description =========== Centreon is a popular monitoring solution. A critical vulnerability has been found in the Centreon logging class allowing remote users to...

Centreon 2.5.3 - Remote Command Execution

Centreon 2.5.3 - Remote Command Execution Unauthenticated Remote Command Execution in Centreon Web Interface ================================================================== Description =========== Centreon is a popular monitoring solution. A critical vulnerability has been found in the Centreo...

JSN PowerAdmin 2.3.0 Code Exection / CSRF / XSS

--------------------------------------------------------- RatioSec Research Security Advisory RS-2016-001 --------------------------------------------------------- JSN PowerAdmin Joomla! Extension Remote Command Execution Via CSRF and XSS vulnerabilities...

IBM Lotus Domino R8 - Password Hash Extraction Exploit

Exploit for windows platform in category web applications Exploit Title: IBM Lotus Domino = R8 Password Hash Extraction Exploit Google Dork: inurl:names.nsf?opendatabase Date: 02-24-2016 Exploit Author: Jonathan Broche Contact: https://twitter.com/g0jhonny Vendor Homepage:...

IBM Lotus Domino R8 - Password Hash Extraction

IBM Lotus Domino R8 - Password Hash Extraction Exploit Title: IBM Lotus Domino = R8 Password Hash Extraction Exploit Google Dork: inurl:names.nsf?opendatabase Date: 02-24-2016 Exploit Author: Jonathan Broche Contact: https://twitter.com/g0jhonny Vendor Homepage:...

WordPress Extra User Details 0.4.2 Plugin - Privilege Escalation Exploit

Exploit for php platform in category web applications """ Exploit Title: Extra User Details Privilege Escalation Discovery Date: 2016-02-13 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://vadimk.com/ Software Link:...

WordPress Plugin Extra User Details 0.4.2 - Privilege Escalation

WordPress Plugin Extra User Details 0.4.2 - Privilege Escalation """ Exploit Title: Extra User Details Privilege Escalation Discovery Date: 2016-02-13 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://vadimk.com/ Software Link:...

WordPress Plugin Extra User Details 0.4.2 - Privilege Escalation

""" Exploit Title: Extra User Details Privilege Escalation Discovery Date: 2016-02-13 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://vadimk.com/ Software Link: https://wordpress.org/plugins/extra-user-details/ Version: 0.4.2 Tested on:...

OpenCms 9.5.2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-063 Product: OpenCms Official Maintainer: Alkacon Software GmbH Affected Versions: 9.5.2 Tested Versions: 9.5.2 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Maintainer Notification:...

F5 Networks BIG-IP : NTP vulnerability (K71245322)

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero. CVE-2015-8138 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks...

F5 BIG-IP - glibc vulnerability CVE-2015-7547

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

LeaseWeb: MISSING SPF RECORDS & MISSING DKIM POLICY

Missing SPF Records and DKIM policy ----------------------------------------------------- At this moment the leaseweb.com domain is missing the appropriate SPF records and DKIM policy. We are aware of the attack scenarios and currently working on a solution. We will add the missing SPF records an...

SOLIDserver <= 5.0.4 - Local File Inclusion

Exploit for php platform in category web applications Title: SOLIDserver =5.0.4 - Local File Inclusion Vunerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: SOLIDserver Tested Version: : 5.0.4 and 4.0.2 Vendor: efficient IP http://www.efficientip.com Google Dork: SOLIDserve...

Atlassian Bamboo Multiple Vulnerabilities (Feb 2016)

Atlassian Bamboo is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:atlassian:bamboo";...

Prezi Bug Bounty #5 - CS Cross Site & Redirect Vulnerability

Document Title: =============== Prezi Bug Bounty 5 - CS Cross Site & Redirect Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1724 Release Date: ============= 2016-02-19 Vulnerability Laboratory ID VL-ID: ===================================...

FreeBSD : adminer -- XSS vulnerability (18201a1c-d59a-11e5-8fa8-14dae9d210b8)

Jakub Vrana reports : Fix XSS in indexes non-MySQL only %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in sourc...

DOKEOS ce30 Authentication Bypass

Advisory ID: HTB23289 Product: DOKEOS Vendor: DOKEOS Vulnerable Versions: ce30 and probably prior Tested Version: ce30 Advisory Publication: January 7, 2016 without technical details Vendor Notification: January 7, 2016 Public Disclosure: February 17, 2016 Vulnerability Type: Improper...