The vulnerability in the rConfig network device configuration management web application for the CentOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows an attacker to execute arbitrary commands on the target system.

The vulnerability in the rConfig network device configuration management web application for the CentOS operating system relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting

Exploit Title: nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.nopcommerce.com/ Version: 4.30 Tested on: Windows 10/Kali Linux CVE: CVE-2020-29475 Stored Cross-site scriptingXSS: Stored XSS, also...

OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting

Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Windows 10/Kali Linux CVE:...

Why Replace Traditional Web Application Firewall (WAF) With New Age WAF?

At present, web applications have become the top targets for attackers because of potential monetization opportunities. Security breaches on the web application can cost millions. Strikingly, DNS Domain Name System related outage and Distributed denial of service DDoS lead a negative impact on...

VTiger v7.0 CRM - 'To' Persistent XSS

Exploit Title: VTiger v7.0 CRM - 'To' Persistent XSS Date: 2020-11-18 Exploit Vulnerability-Lab Vendor Homepage: https://www.vtiger.com/open-source-crm/download-open-source/ Software Link: https://sourceforge.net/projects/vtigercrm/files/ Version: v7.0 Document Title: =============== VTiger v7.0...

Wonder CMS 3.1.3 Cross Site Scripting

Exploit Title: WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting Date: 20-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.wondercms.com/ Version: 3.1.3 Tested on: Windows 10/Kali Linux Stored Cross-site scriptingXSS: Stored XSS, also known as persistent XS...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability (CNVD-2021-29455)

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...

Vtiger CRM 7.0 Cross Site Scripting

Document Title: =============== VTiger v7.0 CRM - To Persistent Email Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2227 Release Date: ============= 2020-11-18 Vulnerability Laboratory ID VL-ID: ==================================== 2227...

Drupal 7.x, 8.x, 9.x RCE Vulnerability (SA-CORE-2020-012) - Linux

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting

Exploit Title: WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting Date: 20-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.wondercms.com/ Version: 3.1.3 Tested on: Windows 10/Kali Linux CVE: CVE-2020-29233 Stored Cross-site scriptingXSS: Stored XSS, also...

Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

Jupyter Notebook redirection vulnerability

Jupyter Notebook is an open source web application that allows you to create and share documents containing live code, equations, visualizations, and narrative text.A redirection vulnerability exists in versions prior to Jupyter Notebook 6.1.5. An attacker can exploit this vulnerability to redire...

IBM Spectrum Protect Operations Center 7.1.x < 7.1.11.000 / 8.1.x < 8.1.10.000 Code Injection Vulnerability

The IBM Spectrum Protect Operations Center running on the remote host is version 7.1.x 7.1.11.000 or 8.1.x 8.1.10.000. It is, therefore, vulnerable to a code injection vulnerability which could allow an unauthenticated, remote attacker to execute arbitrary code on the system. Note that Nessus has...

Dell EMC RSA Archer Injection Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An injection vulnerability exists in Dell EMC RSA Archer versions 6.8...

CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

Design/Logic Flaw

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

It's universal: We all love to exchange gifts. Singles' Day and Diwali are two more reasons to do so.

There is scientific evidence that humans secrete "feel good" chemicals in their brain, such as serotonin, dopamine, and oxytocin, while giving. So it's no wonder that many of us look forward to the holidays. Online mobile shopping trends for Singles' Day and Diwali certainly confirm that. Sadly,...

VTiger v7.0 CRM - (To) Persistent Email Vulnerability

Document Title: =============== VTiger v7.0 CRM - To Persistent Email Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2227 Release Date: ============= 2020-11-18 Vulnerability Laboratory ID VL-ID: ==================================== 2227...