CVE-2017-2613

CVE-2017-2613 concerns Jenkins where certain admin GET actions can trigger CSRF to create users. Affected products/versions: Jenkins core vulnerable before 2.44 and 2.32.x before 2.32.2 (also affecting related Jenkins products in advisories). Root cause: possible CSRF via HTTP GET that enables cr...

Phabricator: Administrator can create user without entering high security mode

When an administrator wants to create a user, he can go to https://phabricator.example.com/people/create/ and will be required to enter his MFA token in order to enter high security mode. However, if an administrator goes to https://phabricator.example.com/people/new/standard/ he will bypass the...

TP-Link EAP Controller and Omada Controller Cross-Site Scripting Vulnerability (CNVD-2018-09302)

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A cross-site scripting vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows. A remote attacker can...

CVE-2018-10165

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...

Cross site scripting

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...

CVE-2018-10165

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...

CVE-2018-10165

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...

BEESCMS Cross-Site Request Forgery Vulnerability

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in BEESCMS version 4.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of...

Apache CouchDB 1.7.0 2.x 2.1.1 - Remote Privilege Escalation

Apache CouchDB 1.7.0 2.x 2.1.1 - Remote Privilege Escalation !/usr/bin/env python ''' @author: r4wd3r @license: MIT License @contact: [email protected] ''' import argparse import re import sys import requests parser = argparse.ArgumentParser description='Exploits the Apache CouchDB JSON Remote...

Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User)

Exploit Title: Cross Site Request Forgery- Frog CMS Date: 31-03-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://github.com/philippe/FrogCMS Version: 0.9.5 CVE : CVE-2018-8908 Category: Webapp CMS 1...

GitStack 2.3.10 Unsanitized Argument Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GitStack Unsanitized Argument RCE', 'Description' = %q This module exploits a remote code execution vulnerability that exists in GitStack through...

Western Bridge Cobub Razor Cross-Site Request Forgery Vulnerability

Western Bridge Cobub Razor is an open source mobile application analytics system. The system can provide users with detailed multi-dimensional reports and monitor their mobile applications and applications user behavior statistics. A cross-site request forgery vulnerability exists in Western Brid...

D-Link DGS-3000-10TC Cross-Site Request Forgery Vulnerability

The D-Link DGS-3000-10TC is a network switch from AUO D-Link. A cross-site request forgery vulnerability exists in the firmware of the D-Link DGS-3000-10TC version 2.00.006, which can be exploited by an attacker to change configuration settings and create new users...

CVE-2018-7480

The blkcginitqueue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service double free or possibly have unspecified other impact by triggering a creation failure...

Exploit for Improper Input Validation in Joomla Joomla\!

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明：目前来看，本项目会进行长期维护，有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 Discuz - Discuz＜3.4birthprovince前台任意文件删除 DedeCMS - DedeCMSv5.7shopsdelivery存储型XSS - DedeCMSv5.7carbuyaction存储型XSS - DedeCMSv5.7友情链接CSRFGetShell Drupal - Drupal远程代码执行漏洞CVE-2017-6920 Struts -...

CVE-2018-7304

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...

Input validation

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...

CVE-2018-7304

CVE-2018-7304 affects Tiki Wiki CMS Groupware (Tiki) version 17.1. The vulnerability arises because the application does not validate user input containing special characters in CSV fields, enabling CSV Injection that can trigger commands on the victim’s machine (for example, an input payload lik...

CVE-2018-7304

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...