TerraMaster TOS Session Fixation Vulnerability

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A session fixation vulnerability exists in the web application in TerraMaster TOS...

Cross site scripting

Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username...

Directory traversal

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-14893

CVE-2018-14893 concerns ZyXEL NSA325 V2 (firmware version 4.81) with a command injection vulnerability in the zyshclient component. The flaw permits an attacker to execute system commands via the web application API. Multiple sources (NVD, CVE records, CNVD) describe the same issue, identifying z...

CVE-2018-14893

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

CVE-2018-14892

The CVE concerns ZyXEL NSA325 V2 (firmware 4.81) web application CSRF vulnerability: missing CSRF protections allows state-changing actions via crafted HTTP forms. The issue is described across multiple sources (CVE record, CNVD, CVE list) as a CSRF weakness enabling unauthorized state changes; n...

CVE-2018-14892

Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

Cross site request forgery (csrf)

Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow attackers to perform state-changing actions via crafted HTTP forms...

Command injection

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

Session fixation

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-14893

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

TIDoS-Framework v1.7 - The Offensive Manual Web Application Penetration Testing Framework

TIDoS Framework is a comprehensive web-app audit framework. let's keep this simple Highlights :- The main highlights of this framework is: TIDoS Framework now boasts of a century+ of modules. A complete versatile framework to cover up everything from Reconnaissance to Vulnerability Analysis. Has ...

TIBCO Statistica Server TIBCO Statistica Component Cross-Site Scripting Vulnerability

TIBCO Statistica Server is a suite of job servers from TIBCO Software that provides a governance framework for shared workspaces and reusable templates.Statistica is one of the components... A cross-site scripting vulnerability exists in the web application of the TIBCO Statistica component in...

zzzcms V1.5.7 php official version of the background file upload vulnerability

zzcms is a free and open source building system, mainly facing the majority of webmasters to use. zzzcms V1.5.7 php official version of the background file upload vulnerability, an attacker can use the vulnerability to obtain control of the web server...

Cross site scripting

The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and...

CVE-2018-18807

The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and...

Ticketly 1.0 - 'kind_id' SQL Injection

Exploit Title: Ticketly 1.0 – Multiple SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-11-19 Google Dork: N/A Vendor: Abisoft https://abisoftgt.net Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql Affected Version:...