CVE-2018-0535

Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified vectors...

Fortinet FortiWeb Access Control Error Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

rider.foodpanda.pk XSS vulnerability

Open Bug Bounty ID: OBB-584698 Description| Value ---|--- Affected Website:| rider.foodpanda.pk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ManageEngine Desktop Central <= 9.1.099 Multiple XSS Vulnerabilities

ManageEngine Desktop Central is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Exponent CMS 2.4.1 Patch 5 - Privilege Escalation Vulnerability

Exponent CMS allows rogue admins to elevate their privileges. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Arbitrary file reading vulnerability in program_index_receive_db.php page of Dreamline Monxin commercial enterprise station-building system

Monxin Business Enterprise Building System is an open source program that runs on PHP+MySQL. An arbitrary file reading vulnerability exists in the programindexreceivedb.php page of the Monxin Business and Enterprise Building System. An attacker can exploit the vulnerability to read arbitrary file...

CVE-2014-3626

The CVE-2014-3626 vulnerability affects the Grails Resource Plugin (pre-1.2.13). A directory-traversal protection bug caused the plugin to return the decoded URI after the traversal check instead of the normalized URI, enabling a double-decoding issue. The fixed behavior repeatedly decodes the UR...

ara.ac.nz XSS vulnerability

Open Bug Bounty ID: OBB-582548 Description| Value ---|--- Affected Website:| ara.ac.nz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lokale.suche.web.de XSS vulnerability

Open Bug Bounty ID: OBB-582470 Description| Value ---|--- Affected Website:| lokale.suche.web.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Taipan - Web Application Security Scanner

Taipan is a an automated web application scanner which allows to identify web vulnerabilities in an automatic fashion. This project is the core engine of a broader project which include other components, like a web dashboard where you can manage your scan or download a PDF report and a scanner...

PYSEC-2018-113

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application...

CVE-2018-1000126

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application...

Information disclosure

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application...

CVE-2018-1000126

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application...

AIO OS Command Injection and Exploitation Tool: Commix

Commix short for comm and i njection e x ploiter is an automated tool written by Anastasios Stasinopoulos @ancst that can be used from web developers, penetration testers or even security researchers in order to test web-based applications with the view to find bugs, errors or vulnerabilities...

bcodental.nl XSS vulnerability

Open Bug Bounty ID: OBB-578696 Description| Value ---|--- Affected Website:| bcodental.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Trend Micro Smart Protection Server Session Hijacking Via Log File Disclosure

The Trend Micro Smart Protection Server running on the remote host is affected by a session hijacking vulnerability due to the disclosure of session IDs in the diagnostic.log file that can be accessed via HTTP without authentication. An unauthenticated, remote attacker can grab the log file and...

Quest DR Series Appliance Web Default Administrator Credentials

The web interface for the Quest DR Series disk backup appliance, formerly Dell DR Series, uses a default set of credentials administrator / St0r@ge! to control access to its management interface. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable...

Polycom QDX 6000 Cross-Site Scripting Vulnerability

The Polycom QDX 6000 devices is a video conferencing endpoint device from Polycom. A cross-site scripting vulnerability exists in the Web application feature of the Polycom QDX 6000 devices. A remote attacker can exploit this vulnerability to execute arbitrary Javascript code in a user's web...

CVE-2018-7746

An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin...