3196 matches found
Arbitrary Code Execution
vim is vulnerable to arbitrary code execution. The vulnerability exists if a user was tricked into executing the "helptags" command on malicious data, arbitrary code could be executed with the permissions of the user running Vim...
Arbitrary Code Execution
cups is vulnerable to arbitrary code execution. The vulnerability exists in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed...
NagiosXI 5.6.11 start / end / step Remote Code Execution Exploit
Exploit for php platform in category web applications Title: Postauth RCE in NagiosXI 5.6.11 Vendor: www.nagios.com Vulnerable software: https://www.nagios.com/downloads/nagios-xi/vmware/ Repo: https://github.com/c610/free/ email protected:/src/eonila/nagiospox$ cat nagiospox.py !/usr/bin/env...
Symantec Web Gateway 5.0.2.8 Remote Code Execution
Title: Postauth RCE in Symantec Web Gateway 5.0.2.8 Date: 27.03.2020 Vendor: www.symantec.com Vulnerable software: www.symantec.com Repo: https://github.com/c610/free/ POST /spywall/timeConfig.php HTTP/1.1 Host: 192.168.216.133 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:73.0...
NagiosXL 5.6.11 orderby SQL Injection
Title: Postauth SQL injection in NagiosXI 5.6.11 param: orderby Date: 13.03.2020 Vendor: https://www.nagios.com/ Vulnerable software: https://www.nagios.com/downloads/nagios-xi/vmware/ Repo: https://github.com/c610/free/ c@kali:$ cat n2.txt GET...
Improper Authorization vulnerability in FortiADC
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system...
PT-2020-3648 · Apache · Apache Traffic Server
Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 6.0.0 through 6.2.3 Apache Traffic Server versions 7.0.0 through 7.1.8 Apache Traffic Server versions 8.0.0 through 8.0.5 Description: The issue is related to inconsistent interpretation of HTTP requests, which...
PT-2020-12093 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited by injecting arbitrary web script or HTML in...
PT-2020-12143 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the sort parameter in the "admin/manage-categories.php" page, enabling reflected XSS attacks. Recommendations: F...
PT-2020-12128 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to delete any folder on the web server, potentially causing a Denial of Service. This is achieved by using a dot-dot-slash sequence ../ via the crdir...
Cross-site Scripting (XSS)
ckeditor4 is vulnerable to cross-site scripting XSS. The attack exists because HTML Data Processor does not discard the comment with ckeprotected syntax, allowing an attacker to inject malicious script with that syntax...
The vulnerability of the HNAP microprogramming software for D-Link’s wireless HD cameras series DCS allows a intruder to execute any code on the target device.
The vulnerability of the HNAP microprogramming software for D-Link’s wireless HD cameras of the DCS series lies in buffer overflow in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target device by sending a specially crafted SOAP request to the...
Remote Code Execution (RCE)
ansible is vulnerable to remote code execution RCE. The pipe lookup plugin is set to shell=True by default when using subprocess.Popen, allowing to remote code execution through the overwriting of ansible facts due to the lack of sanitization of variables...
Denial Of Service
libexiv2.so is vulnerable to denial of service DoS. The attack exists when an attacker provide a malicious input to Jp2Image::readMetadata in jp2image.cpp, causing an infinite loop and high CPU usage...
PT-2020-18907 · Accusoft · Accusoft Imagegear
Name of the Vulnerable Software and Affected Versions: Accusoft ImageGear version 19.5.0 Description: A specially crafted PNG file can cause an out-of-bounds write in the igcore19d.dll PNG pngread parser, resulting in remote code execution. An attacker needs to provide a malformed file to the...
SQL Injection
increments is vulnerable to SQL injection. The vulnerability exists as it improperly handles voting data, and allows additional votes to be created...
PT-2020-1744 · Cisco · Cisco Small Business Switches
Name of the Vulnerable Software and Affected Versions: Cisco Small Business Switches versions 200, 250, 300, 350, 350X, 500, 550X Description: The issue is related to inadequate data processing in the web interface of the affected devices, which could allow a remote attacker to gain unauthorized...
Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the user's email, causing the payload to be rendered and executed on pages that displays the malicious email address...
PT-2020-18492 · Gila · Gila Cms
Name of the Vulnerable Software and Affected Versions: Gila CMS version 1.11.8 Description: The issue allows for SQL Injection through the /admin/sql endpoint with a query parameter. This can potentially lead to unauthorized access or manipulation of database content. Recommendations: For Gila CM...