Magento Commerce Server-Side Request Forgery Vulnerability

Exploit for php platform in category web applications Document Title: =============== Magento Commerce - SSRF & XSPA Web Vulnerability Vulnerability Class: ==================== Server Side Request Forgery Product & Service Introduction: =============================== Magento is an open source...

westendstage.com XSS vulnerability

Open Bug Bounty ID: OBB-516170 Description| Value ---|--- Affected Website:| westendstage.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

CVE-2017-18014

An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...

Taxi Booking Script 1.0 - Cross-site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo:...

Flash Operator Panel 2.31.03 Command Execution

Document Title: =============== Flash Operator Panel v2.31.03 - Command Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1907 Release Date: ============= 2018-01-08 Vulnerability Laboratory ID VL-ID:...

Magento Commerce Server-Side Request Forgery

Document Title: =============== Magento Commerce - SSRF & XSPA Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1631 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID VL-ID: ==================================== 1631 Comm...

Microsoft Skypexspaces - DNS Squatting Web Vulnerability

Document Title: =============== Microsoft Skypexspaces - DNS Squatting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2112 Release Date: ============= 2018-01-12 Vulnerability Laboratory ID VL-ID: ====================================...

Microsoft Skypexspaces - DNS Squatting Web Vulnerability

Document Title: =============== Microsoft Skypexspaces - DNS Squatting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2112 Release Date: ============= 2018-01-12 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress Tabs Plugin <= 1.8.0 XSS Vulnerability

The WordPress plugin Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Media From FTP Plugin < 9.85 Directory Traversal Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112188";...

Archery - Open Source Vulnerability Assessment And Management Helps Developers And Pentesters To Perform Scans And Manage Vulnerabilities

Archery is an opensource vulnerability assessment and management tool which helps developers and pentesters to perform scans and manage vulnerabilities. Archery uses popular opensource tools to perform comprehensive scaning for web application and network. It also performs web application dynamic...

CVE-2014-5068

Directory traversal vulnerability in the web application in Symmetricom s350i 2.70.15 allows remote attackers to read arbitrary files via a 1 ../ dot dot slash or 2 ..\ dot dot forward slash before a file name...

CVE-2014-5068

Summary: CVE-2014-5068 is a directory traversal vulnerability in the web application of Microsemi/Microsemi Symmetricom s350i (version 2.70.15). The issue allows remote attackers to read arbitrary files by using file name prefixes like ‘../’ or ‘..\’ before the target file name. The connected CNV...

Wallarm Joins NVIDIA AI Virtual Accelerator

We are thrilled to announce that Wallarm has joined the NVIDIA Inception program, which is designed to nurture startups revolutionizing industries with advancements in AI and data sciences. NVIDIA’s Inception program is a virtual accelerator that helps startups during critical stages of product...

Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access(CVE-2017-18014)

Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center...

Cross-Site Scripting Vulnerability in CloudLock WAF

CloudLock is a free server security management software based on OS kernel hardening technology. A cross-site scripting vulnerability exists in CloudLock WAF. The vulnerability is due to CloudLock failing to adequately filter cross-site scripting. An attacker can exploit this vulnerability to...

Web Application Vulnerability Scanner: Wapiti

Wapiti allows you to audit the security of your web applications. It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets this list, Wapiti act...

Oracle WebLogic Server WLS Security Component Deserialization Vulnerability

Added: 01/09/2018 BID: 101304 Background Oracle WebLogic Server formerly BEA WebLogic Server is a Java web application platform. Problem Oracle WebLogic Server has a vulnerability in the WLS Security wls-wsat component that could allow an unauthenticated remote attacker who has HTTP access to the...

Wapiti 3.0.0 - The Web-Application Vulnerability Scanner

Wapiti allows you to audit the security of your websites or web applications. It performs "black-box" scans it does not study the source code of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets the list of...

milanoo.com XSS vulnerability

Open Bug Bounty ID: OBB-501159 Description| Value ---|--- Affected Website:| milanoo.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based o...