IBM Water Operations for Waternamics and IBM Intelligent Operations Center Input Validation Error Vulnerability

IBM Intelligent Operations Center IOC and IBM Water Operations for Waternamics are both products of IBM Corporation, U.S.A. IBM Intelligent Operations Center is a suite of city operations solutions. IBM Intelligent Operations Center is a suite of city operations solutions with features such as da...

Security Bulletin: IBM® Intelligent Operations Center has a weak user-creation policy (CVE-2019-4066)

Summary An authenticated user can create users with malformed user IDs in IBM® Intelligent Operations Center so that these new users cannot be deleted later from the system. Because the malformed users cannot be deleted at the application level, this is a denial of service issue. Vulnerability...

SoftNAS Cloud Command Execution Vulnerability

SoftNAS Cloud is a software-defined NAS file management system from US-based SoftNAS. The system is primarily used to provide enterprise-class NAS functionality, including encryption, snapshots and automatic failover. A security vulnerability exists in SoftNAS Cloud versions 4.2.0 and 4.2.1. A...

Cross-Site Scripting (XSS)

nexus-core is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the repoId and format parameters of the healthCheckFileDetail function, the file name in the File Upload functionality of Staging Upload, the username when...

njiandan-cms cross-site request forgery vulnerability

njiandan-cms is a PHP-based content management system CMS. A cross-site request forgery vulnerability exists in njiandan-cms version 2013-05-23 and earlier. A remote attacker can exploit this vulnerability to add an administrator account with the help of the index.php/admin/usernew URL...

LayerBB 1.1.2 Cross Site Request Forgery

Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery Date: 10/4/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com Version: 1.1.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-17996 1. Description: LayerBB is a free open-source forum software, the CSRF...

snapd 2.37 (Ubuntu) dirty_sock Local Privilege Escalation

!/usr/bin/env python3 """ dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available...

Exploit for Incorrect Authorization in Canonical Snapd

dirtysock: Linux Privilege Escalation via snapd In January...

Ubuntu snapd < 2.37.1 - Local Privilege Escalation

dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and educatio...

The vulnerability of the account management utility for the Shadow operating system in Astra Linux, which allows a hacker to trigger a service failure

The vulnerability of the account management utility for the Shadow operating system Astra Linux relates to the incorrect assignment of the permission level during user creation. Exploiting this vulnerability allows an attacker with privileged user rights to block access for newly created users...

The vulnerability of the fly-admin-gmc component, a graphical tool for administering domains and clients in the ALD fly-admin-ald-server operating system of Astra Linux, allows a perpetrator to cause service interruptions.

The vulnerability of the fly-admin-gmc graphical tool for administering domains and clients in the Astra Linux operating system relates to the improper assignment of token attributes during user creation in ALD. Exploiting this vulnerability allows an attacker to block new users from accessing th...

CloudBees Jenkins and LTS Denial of Service Vulnerability (CNVD-2020-20409)

CloudBees Jenkins formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins a long-term...

The vulnerability of network monitoring software for PRTG Network Monitor lies in the insecure management of privileges. This allows a malicious actor with the “read-only” privilege to create users with the “read-write” privilege.

The vulnerability of the network monitoring software PRTG Network Monitor relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, who has the “read-only” privilege, to create users with “read-write” privileges, including administrators, by using ...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

LanSpy 2.0.1.159 - Local Buffer Overflow

LanSpy 2.0.1.159 - Local Buffer Overflow !/usr/bin/python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: LanSpy 2.0.1.159 - Local Buffer Overflow RCEPoC Date: 2018-12-16 Author: Juan Prescotto Tested...

Synaccess netBooter NP-02x/NP-08x 6.8 - Authentication Bypass

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0201D ver 6.8C NP-02 ver 6.5C NP-02 ver 6.4BC NP-0801D ver 6.4A NP-08 ver 6.10 NP-02 ver 5.53BC Summary: netBooter NP-02B and NP-02BH...

TerraMaster TOS System Command Injection Vulnerability (CNVD-2019-00665)

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A system command injection vulnerability exists in the ajaxdata.php endpoint in...

TerraMaster TOS System Command Injection Vulnerability (CNVD-2019-00663)

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. TerraMaster TOS3.1.03 version of the ajaxdata.php file exists in the system command...

Command injection

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...