Code injection

DISPUTED An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an...

CheerWeb has a file upload vulnerability

CheerWeb is a general-purpose website system designed with PHP+MySQL architecture, which is simple, lightweight, practical, free and shared. CheerWeb suffers from a file upload vulnerability, which can be exploited by an attacker to upload arbitrary files and gain webmaster privileges...

Openfire 4.4.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1 Affected Software: Openfire Affected Versions: 4.4.1 Vendor Homepage: https://www.igniterealtime.org/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fix...

Default credentials

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal...

Tachyon - Fast HTTP Dead File Finder

Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.5.2 User Installation Install: $...

Chunked Transmission Bypass Vulnerability in Netnifty Web Application Security Protection System

Beijing Netnifty Information Technology Co., Ltd. was renamed from Lenovo Netnifty Technology Beijing Co., Ltd. which was formerly known as Lenovo Group's Information Security Division. A chunked transmission bypass vulnerability exists in the NetGuard Web Application Security Protection System,...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

CVE-2019-3761

The CVE-2019-3761 entry describes a stored cross-site scripting vulnerability in RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products released before 7.1.0 P08, specifically in the Access Request module. A remote authenticated attacker could store malicious HTML or ...

Alkacon OpenCMS 10.5.x - Cross-Site Scripting

Alkacon OpenCMS 10.5.x - Cross-Site Scripting Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/apollo-template Version: 10.5.x Tested on...

Django CRM 0.2.1 Cross Site Request Forgery

Information -------------------- Advisory by Netsparker Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1 Affected Software: Django CRM Affected Versions: 0.2.1 Homepage: https://github.com/MicroPyramid/Django-CRM Vulnerability: Cross-site Request Forgery Severity: 8.8 High Status: Not Fixe...

TeamPass <= 2.1.27.36 Multiple XSS Vulnerabilities

TeamPass is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Daily Expense Manager 1.0 - Cross-Site Request Forgery Delete Income Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager...

Zurmo 3.2.6 Open Redirection

Open Redirection Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Open Redirection Vulnerability in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Open Redirection Severity: Medium Status: Not Fixed...

Zurmo 3.2.6 Out Of Band Code Evaluation

Out of Band Code Evaluation Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Out of Band Code Evaluation in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Out of Band Code Evaluation Severity: Critical...

CVE-2019-12725

Zeroshell 3.9.0 is affected by a remote command execution vulnerability in the web application, caused by mishandling of HTTP parameters, allowing unauthenticated attackers to inject and execute arbitrary OS commands. The issue primarily affects the web interface (e.g., the vulnerable parameter h...

CVE-2019-13071

CVE-2019-13071 affects PowerPanel Business Edition 3.4.0 (Agent/Center component). The vulnerability is a CSRF flaw that allows an attacker to submit POST requests to arbitrary forms within the web application by convincing an authenticated user to visit a malicious page. This can enable actions ...

CVE-2019-9147

Mailvelope CVE-2019-9147 affects the Mailvelope browser extension before version 3.1.0. The vulnerability is a clickjacking issue on the settings page, which is intended to be embedded by web apps. The problem arises because the browser extension isolation mechanisms are disabled via web_accessib...

5 Years of Fighting DDoS with the Power of Akamai

Additional analysis and research provided by Principal Architect, Tom Emmons Earlier this year, Akamai celebrated the fifth anniversary of the Prolexic acquisition. The merger was officially completed in February of 2014, and a lot has happened since then. In this post, we want to spend a moment...

PT-2019-18492 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series devices affected versions not specified Description: The issue allows for Cross-Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application...

Command Execution Vulnerability in DM Enterprise Website System

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website building system has a command execution vulnerability , attackers can use the vulnerability to obtain server privilege...