Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution

This module exploits an IP whitelist bypass vulnerability in the developer web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also achieve code execution on Rails 4.2.x if the attack is launched from a whitelisted IP range. This module requires Metasploit:...

The vulnerability of the Apache ActiveMQ software platform allows attackers to deploy malicious elements on a page and force users to activate them.

The vulnerability of the Apache ActiveMQ software platform’s web console is related to errors in sending the X-Frame-Options HTTP header. Exploiting this vulnerability allows a malicious actor to deploy malicious elements on a website and force users to activate them through specially crafted web...

Release Notes for Veeam Management Pack 8.0 Update 2

Challenge Release Notes for Veeam Management Pack 8.0 Update 2. Cause Please confirm you are running Veeam Management Pack 8.0 prior to installing this update. You can check this in Operations Manager console under Administration | Management Packs, the build number should be 8.0.0.2218 or later...

pfSense Firewall 2.2.6 - Services Cross-Site Request Forgery

Exploit Title: pfSense Firewall Stop NTPD service: Restart NTPD service: POC: The service w...

pfSense Firewall 2.2.6 - Services Cross-Site Request Forgery

pfSense Firewall 2.2.6 - Services Cross-Site Request Forgery Exploit Title: pfSense Firewall Stop NTPD service: Restart NTPD service: POC: input type="submit" value...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

FreeBSD : activemq -- Web Console Clickjacking (950b2d60-f2a9-11e5-b4a9-ac220bdcec59)

Michael Furman reports : The web-based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. %NASLMINLEVEL 70300 C Tenab...

FreeBSD : activemq -- Web Console XSS (a6cc5753-f29e-11e5-b4a9-ac220bdcec59)

Vladimir Ivanov Positive Technologies reports : Several instances of cross-site scripting vulnerabilities were identified to be present in the web-based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are imprope...

FreeBSD : activemq -- Unsafe deserialization (a258604d-f2aa-11e5-b4a9-ac220bdcec59)

Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports : JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message...

VulnCheck KEV: CVE-2010-1428

Unauthenticated access to the JBoss Application Server Web Console /web-console is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information...

VulnCheck KEV: CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make...

Apache ActiveMQ Web Console Missing X-Frame-Options Clickjacking

The version of Apache ActiveMQ running on the remote host is affected by a clickjacking vulnerability in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attacker can exploit this to trick a user into executing administrative tasks. No...

Apache ActiveMQ Web Console Single Click Hijacking Vulnerability

Apache ActiveMQ is a popular messaging and integration model provider . A security vulnerability exists in Apache ActiveMQ 5.0.0 - 5.13.1 due to an unset X-Frame-Options header for HTTP responses in the Web Management Console. This allows attackers to perform unauthorized operations in the consol...

activemq -- Web Console Cross-Site Scripting

Vladimir Ivanov Positive Technologies reports: Several instances of cross-site scripting vulnerabilities were identified to be present in the web based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are improper...

Moxa NPort's web console! 未授权访问

No description provided by source...

Ruby on Rails Web Console IP 白名单安全模式绕过

IP whitelist bypass in Web Console There is a remote code execution vulnerability in Web Console. This vulnerability has been assigned the CVE identifier CVE-2015-3224. Versions Affected: All Not affected: Environments inaccessible from remote IPs, or without Web Console enabled Fixed Versions:...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

Exploit for php platform in category web applications function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

JexBoss - Jboss Verify And Exploitation Tool

JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server. Requirements Python = 2.7.x Installation To install the latest version of JexBoss, please use the following commands: git clone https://github.com/joaomatosf/jexboss.git cd jexboss python jexboss.py Features...

Commvault Edge Server Web Console OS Command Injection Vulnerability

Commvault Edge Server is a suite of Simpana-based software that provides end-users with automated data protection and instant access. A security vulnerability in the web console of Commvault Edge Server allows remote attackers to execute arbitrary OS commands using specially crafted serialized da...