CVE-2018-18250

CVE-2018-18250 affects Icinga Web 2 prior to version 2.6.2, where crafted navigation item names (notably a single '$') can break navigation dashlets. The issue is documented across multiple sources tied to Icinga Web 2, including openSUSE/SUSE advisories and OSS/OSS-related bulletins, indicating ...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18248

CVE-2018-18248 affects Icinga Web 2 and enables XSS via multiple user-controllable inputs: the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, and the /icingaweb2/setup query string. The connected docume...

CVE-2018-18249

Icinga Web 2 before 2.6.2 is vulnerable to injection of PHP ini-file directives via environment-variable-based channels used as a conduit to exfiltrate information against endpoints such as /icingaweb2/navigation/add and /icingaweb2/dashboard/new-dashlet. Root cause: lack of input validation for ...

CVE-2018-18246

Icinga Web 2 prior to version 2.6.2 is vulnerable to CSRF via modules control endpoints: /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module and /icingaweb2/config/moduleenable?name=setup to enable the setup module. This can be exploited to alter module state without...

CVE-2018-18250

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18250

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

Icinga Web 2 Detection (HTTP)

HTTP based detection of Icinga Web 2. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Microsoft XML Core Services Remote Code Execution Vulnerabilities (2756145)

This host is missing a critical security update according to Microsoft Bulletin MS13-002. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS12-043: Description of the security update for XML Core Services 5.0 when it is installed together with Office 2007, Office Compatibility Pack, Office Word Viewer, Expression Web, or Expression Web 2: August 14, 2012

None None...

PT-2009-4908 · Microsoft · Works +26

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 6 SP1 Windows XP versions SP2 and SP3 Office XP version SP3 Office 2003 version SP3 2007 Microsoft Office System versions SP1 and SP2 Office Project 2002 version SP1 Visio 2002 version SP2 Office Word Viewe...

Microsoft GDI+ PNG File Integer Overflow Remote Code Execution Vulnerability

Description Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly processes PNG image files. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts m...

e107 my_gallery 2.4.1 File Disclosure

MainHack BrotherHood http://news.serverisdown.org Vrs-hCk OoNBoY Paman bL4Ck3n91n3 Angela Zhang H312Y yooogy mousekill ^-^ loqsa zxvf martfella skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke FUCK TERORIS!! / $vuln = '/e107plugins/mygallery/image.php?file='; $trasv =...

CVE-2008-3179

Directory traversal vulnerability in website.php in Web 2 Business W2B phpDatingClub aka Dating Club 3.7 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the page parameter...