CVE-2017-6042

A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a...

Mura CMS Detection

Detection of Mura CMS. The script sends a connection request to the server and attempts to detect Mura CMS and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-6807

It was found that modauthmellon was vulnerable to a cross-site session transfer attack. An attacker with access to one web site on a server could use the same session to get access to a different site running on the same server...

Spark 2.5 Arbitrary File Read

Hey folks, Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related to the project after trying 4 people over 2...

Apache Tomcat JK ISAPI Connector Buffer Overflow Vulnerability

Apache Tomcat JK ISAPI Connector is a module for Apache or IIS to connect to the backend Tomcat , which supports clustering and load balancing and so on. A buffer overflow vulnerability exists in Apache Tomcat JK ISAPI Connector, which allows remote attackers to send specially crafted URIs to the...

CVE-2016-0870

CVE-2016-0870 affects Trane Tracer SC web server (versions 4.2.1134 and earlier). A remote attacker can read sensitive configuration files via a direct request, exposing information from specific directories. NVD assigns CVSSv3 base score 5.3 (Network, Low complexity, No privileges, Confidentiali...

The vulnerability of the Zyxel ZLD operating system allows a remote attacker to execute arbitrary code on the web server.

Exploiting a vulnerability in the operating system of the Zyxel ZyWALL USG 300 network firewall/switch allows a malicious actor to inject any desired web script through the Referer header. This is done by improperly handling the “404” error page, thereby compromising the integrity of data process...

Remote File Inclusion in Gwolle Guestbook WordPress Plugin

High-Tech Bridge Security Research Lab discovered a critical Remote File Inclusion RFI in Gwolle Guestbook WordPress plugin, which can be exploited by non-authenticated attacker to include remote PHP file and execute arbitrary code on the vulnerable system. HTTP GET parameter "abspath" is not bei...

PHP security issues: a remote overflow, DoS, safe_mode bypass vulnerability-vulnerability warning-the black bar safety net

One, the Web serversecurity PHP actually but is the Web server of a module function, so the first thing to ensure Web Server Security. Of course Web server to be secure and must be first to ensure the system safe, so you pull away, endless. PHP can be and various The Web server binding, also here...

X2Engine < 3.7.4 Multiple Vulnerabilities

According to its version number, the X2Engine application installed on the remote web server is prior to version 3.7.4. It is, therefore, potentially affected by multiple vulnerabilities : - Multiple SQL injection vulnerabilities exist in the 'lastEventId' and 'lastTimestamp' HTTP GET parameters ...

The Bash Vulnerability: How to Protect your Environment

A recently discovered hole in the security of the Bourne-Again Shell bash has the majority of Unix/Linux including OS X admins sweating bullets. You should be, too--attackers have already developed exploits to unleash on unpatched web servers, network services and daemons that use shell scripts...

Key Focus Web Server 3.1 Index.WKF Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24623/info Key Focus Web Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code...

IkonBoard 3.1 Lang Cookie Arbitrary Command Execution Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/7361/info It has been reported that IkonBoard is prone to an arbitrary command execution vulnerability. The vulnerability is due to insufficient sanitization performed on user supplied cookie data. An attacker may exploit...

Webbler CMS 3.1.3 Mail A Friend Open Email Relay Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25045/info The 'webbler' is prone to an open-email-relay vulnerability. An attacker may leverage the issue to use webservers that are hosting the vulnerable software to send arbitrary unsolicited bulk email. Attackers may...

HP Onboard Administrator Multiple Vulnerabilities

The remote web server is a version of HP Onboard Administrator OA that is affected by the following vulnerabilities : - HP Onboard Administrator before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors. CVE-2012-0130 - HP Onboard Administrator before 3.50 allows...

Webify (Multiple Products) - Multiple HTML Injection Local File Inclusions

Webify Multiple Products - Multiple HTML Injection Local File Inclusions source: https://www.securityfocus.com/bid/54045/info Multiple Webify products are prone to multiple HTML-injection and local file-include vulnerabilities because they fail to properly sanitize user-supplied input. Exploiting...

Serious Remote PHP Bug Accidentally Disclosed

A serious remote-code execution vulnerability in PHP was accidentally disclosed Wednesday, leading to fears of an outbreak of attacks on sites that were built using vulnerable versions of PHP. The bug has been known privately since January when a team of researchers used it in a capture the flag...

JavaScript eval() Usage on Web Server

Binary data 5723.prm...

HTTP Virtual Host Brute Force Scanner

This module tries to identify unique virtual hosts hosted by the target web server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework May I reuse some methods? require 'cgi' class MetasploitModule 'HTTP Virtual Host Bru...

My Book World Edition NAS Cross Site Scripting

Exploit Title: My Book World Edition NAS multiple vulnerability Date: 20091230 Author: Emanuele 'emgent' Gentili Code: http://www.backtrack.it/emgent/exploits/20091230-NAS.txt Version: 01.01.16 with MioNet 2.3.9.13 firmware. CVE : N/A Vendor: http://www.wdc.com/mybookworld + REMOTE COMMAND...