CVE-2020-13483

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

Cross site scripting

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

CVE-2020-13483

CVE-2020-13483 : Bitrix24 Web Application Firewall (WAF)

CVE-2020-13483

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI...

Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student) Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Student Enrollment System 1.0 - Cross-Site Request Forgery Add Student Exploit Author: BKpatron Vendor Homepage: https://www.campcodes.com/projects/php/4745/online-student-enrollment-system-in-php-mysqli/ Software Link:...

Apache XML Graphics Batik Cross-Site Request Forgery Vulnerability

Apache XML Graphics Batik is the United States Apache Software Apache Software Foundation of a set of Java-based application programs mainly used to deal with SVG format images. A cross-site request forgery vulnerability exists in Apache XML Graphics Batik. The vulnerability stems from the WEB...

Lansweeper 7.2 - Incorrect Access Control

Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...

Mattermost Server Cross-Site Request Forgery Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A cross-site request forgery vulnerability exists in Mattermost Server, which stems from a WEB application that does not adequately validate whether a request is coming from a trusted user, and can ...

Debian DLA-2251-1 : rails security update

Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user input usage, depending on the application. CVE-2020-8164 Strong parameters bypass vector in ActionPack. In some cases us...

College-Management-System-Php 1.0 - SQL Injection

College-Management-System-Php version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection Exploit Author: BLAY ABU SAFIAN Inveteck Global Website:...

K8tools

It is an offensive tool for web application exploitation. The repository, K8tools, contains a collection of tools for various purposes, including internal penetration, privilege escalation, remote overflow, vulnerability exploitation, scanning, password cracking, and anti-kill tools. The primary...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

This is a PoC exploit for CVE-2013-0001, a SQL injection vulnerability scanner written in Python. The target product/service is a web application, and the vulnerability class is SQL injection. The probable entry point is the sqliscanner.py script, which is invoked by running the script with the -...

The vulnerability of the AJP Connector service of the Apache Tomcat application server allows a hacker to gain unauthorized access to read files within web applications.

The vulnerability of the AJP Connector service of the Apache Tomcat application server is related to access control deficiencies. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized read access to files within the web applications...

ulakbag.ulakbim.gov.tr Cross Site Scripting vulnerability OBB-1200600

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-3245

The CVE-2020-3245 issue affects Cisco Smart Software Manager On-Prem (SSM On-Prem) in its web application. A lack of authorization controls allows an unauthenticated, remote attacker to craft HTTP requests that add arbitrary user accounts to the device configuration (these will not be admin or op...

CVE-2020-3337 Cisco Umbrella Open Redirect Vulnerability

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could...

College-Management-System-Php 1.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection Exploit Author: BLAY ABU SAFIAN Inveteck Global Website: https://github.com/olotieno/College-Management-System-Php Vendor: https://github.com/olotieno/...

College-Management-System-Php 1.0 SQL Injection

Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection Exploit Author: BLAY ABU SAFIAN Inveteck Global Website: https://github.com/olotieno/College-Management-System-Php Date: 2020-06-16 Google Dork: N/A Vendor: https://github.com/olotieno/ Software Link:...

Cacti <= 1.2.12 Multiple Vulnerabilities - Linux

Cacti is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability

A vulnerability in the web application of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this...