CVE-2019-9529

Affected product: Cobham EXPLORER 710, firmware 1.07. Vulnerability: The web application portal has no authentication by default, allowing an unauthenticated, local attacker to access the portal and make changes to the device. Impact (as described): unauthenticated access, potential modification ...

Jiangnan Online Judge Cross-Site Scripting Vulnerability

Jiangnan Online Judge is an online evaluation system for computer programming. The system is mainly used for compiling and executing the source code submitted by users and checking the correctness of the program source code. A cross-site scripting vulnerability exists in Jiangnan Online Judge...

What The Actual WAF!?

InfoSec Family, we need to talk!! Every so often, there is a technological shift in the information security industry. Sometimes it is due to new cyberattack discovery, aka a Zero-day. Many times, the catalyst is legacy technology. When a legacy technology no longer adequately responds to the...

Puppet Enterprise < 2015.3.0 Information Disclosure Vulnerability

According to its self-reported version number, the Puppet install on the remote host is affected by an information disclosure vulnerability. An unauthenticated, unpriviledged remote attacker can cause a user to send jsessionid cookies in plain text, allowing the attacker the ability to potentiall...

Puppet Enterprise 2018.x < 2018.1.1 Code Execution Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2018.1.1. It is, therefore, affected by a code execution vulnerability when upgrading the pe-razor-server component. C Tenable Network Security, Inc. include"compat.inc"; if...

LabCollector 5.423 - SQL Injection

Exploit Title: LabCollector Laboratory Information System 5.423 - Multiples SQL Injection Date: 09/09/2019 Software Links/Project: https://www.labcollector.com/clientarea/downloads.php Version: LabCollector Laboratory Information System 5.423 Exploit Author: Carlos Avila Category: webapps Tested...

LabCollector 5.423 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: LabCollector Laboratory Information System 5.423 - Multiples SQL Injection Software Links/Project: https://www.labcollector.com/clientarea/downloads.php Version: LabCollector Laboratory Information System 5.423 Exploit Author:...

AnchorCMS < 0.12.3a - Information Disclosure

Exploit Title: Information disclosure MySQL password in error log Date: 2/10/2019 Exploit Author: Tijme Gommers https://twitter.com/finnwea/ Vendor Homepage: https://anchorcms.com/ Software Link: https://github.com/anchorcms/anchor-cms/releases Version: 0.12.3a Tested on: Linux CVE : CVE-2018-725...

MediaWiki <= 1.33.0 Information Disclosure Vulnerability - Linux

MediaWiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Syhunt Community 6.7 - Web And Mobile Application Scanner

Syhunt Community is a web and now mobile application security scanner. Syhunt is able to scan any kind of application source code for potential security vulnerabilities, pinpointing the exact lines of the code that need to be patched. Or you can simply enter a start URL and get detailed...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2019-33855)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

Cross site scripting

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users...

CloudBees Jenkins and LTS Cross-Site Scripting Vulnerability (CNVD-2019-34784)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

CloudBees Jenkins and LTS Cross-Site Scripting Vulnerability (CNVD-2019-34785)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

anovorx.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-981605 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-16276

It was discovered that net/http through net/textproto in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or ...

Chamilo LMS 1.11.8 Shell Upload Exploit

Exploit for php platform in category web applications PHP Test FILE UPLOAD'; $tgtdir = "uploads/"; $tgtfile = $tgtdir.basename$FILES'fileToUpload''name'; echo "TARGET FILE= ".$tgtfile; //$filename = $FILES'fileToUpload''name'; echo "FILE NAME FROM VARIABLE:- ".$FILES"fileToUpload""name...

Atlassian JIRA 7.7.x < 7.13.1 XSS vulnerability (JRASERVER-69238)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.13.1. It is therefore, potentially affected by a cross-site scripting XSS vulnerability in the cyclePeriod parameter due to improper validation of user-supplied input data. ...

F5 BIG-IP ASM Information Disclosure Vulnerability

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A security vulnerability exists in the F5 BIG-IP ASM. An attacker could exploit the vulnerability ...

Fortinet FortiClient Enterprise Management Server Cross-Site Scripting Vulnerability

Fortinet FortiClient Enterprise Management Server EMS is a FortiClient Enterprise Manager from Fortinet. It is designed for scalable and centralized management of multiple FortiClients. A cross-site scripting vulnerability exists in Fortinet FortiClient EMS 6.2.0 and earlier versions, which stems...