The vulnerability of the HTTP-server of the microprogramming-based VPN router TP-Link TL-R600VPN allows a intruder to gain unauthorized access to protected information.

The vulnerability of the HTTP server of the microprogrammed VPN router TP-Link TL-R600VPN relates to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information ...

Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Exploit Author: MTK Vendor Homepage: https://sweethawk.co/zendesk/survey-app Software Link: https://www.zendesk.com/apps/support/survey/ Version: Up to v1.6...

File write vulnerability in Ocean CMS ad***_pi***.php page

Ocean CMS is a web content management system based on PHP+MYSQL architecture that can run across platforms. A file write vulnerability exists in the Ocean CMS adpi.php page. An attacker can exploit this vulnerability to gain control of the web server...

Unrestricted file uploads

Date : 2019-12-17 CVE ID : CVE-2019-19745 Description A back end user with access to the form generator can upload arbitrary files and execute them on the server. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4.8 up t...

The vulnerability in the Administrator web console of the McAfee Web Gateway web server allows a perpetrator to carry out a clickjacking attack.

The vulnerability of the Administrator web console of the McAfee Web Gateway lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out a clickjacking attack using a specially crafted web page...

Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting

Exploit Title: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting Date: 2019-12-17 Exploit Author: MTK Vendor Homepage: https://sweethawk.co/zendesk/survey-app Software Link: https://www.zendesk.com/apps/support/survey/ Version: Up to v1.6 Tested on: Zendesk - Firefox/Windows...

CVE-2019-13944

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13944

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

Code injection

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13944

CVE-2019-13944 affects Siemens EN100 Ethernet Module family (DNP3, IEC61850

CVE-2019-13942

A vulnerability has been identified in EN100 Ethernet module DNP3 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module IEC104 variant All versions, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO variant A...

CVE-2019-13927

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

CVE-2019-13927

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

CVE-2019-13927

CVE-2019-13927 affects Siemens Desigo PX devices with web interfaces (web server on tcp/80). A specially crafted HTTP message can cause the web server to respond with 404 to subsequent requests, degrading availability; recovery requires a reboot. Affected families include PXC00-E/D, PXC50-E/D, PX...

PT-2019-13485 · Hms Networks · En100 Ethernet Module Iec 61850 Variant +4

Name of the Vulnerable Software and Affected Versions: EN100 Ethernet module DNP3 variant All versions EN100 Ethernet module IEC 61850 variant All versions V4.37 EN100 Ethernet module IEC104 variant All versions EN100 Ethernet module Modbus TCP variant All versions EN100 Ethernet module PROFINET ...

Bullwark Momentum Series JAWS 1.0 Directory Traversal

Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal Date: 2019-12-11 Author: Numan Türle Vendor Homepage: http://www.bullwark.net/ Version : Bullwark Momentum Series Web Server JAWS/1.0 Software Link : http://www.bullwark.net/Kategoriler.aspx?KategoriID=24 POC --------- GET...

Bullwark Momentum Series JAWS 1.0 - Directory Traversal

Bullwark Momentum Series JAWS 1.0 - Directory Traversal Title: Bullwark Momentum Series JAWS 1.0 - Directory Traversal Date: 2019-12-11 Author: Numan Türle Vendor Homepage: http://www.bullwark.net/ Version : Bullwark Momentum Series Web Server JAWS/1.0 Software Link :...

Cross site request forgery (csrf)

Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform Monitoring Application, before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery...

Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution Author: LiquidWorm Product web page: https://www.inim.biz Link:...

Inim Electronics Smartliving SmartLAN 6.x - Unauthenticated Server-Side Request Forgery Vulnerabilit

Exploit for hardware platform in category web applications Exploit Title: Inim Electronics Smartliving SmartLAN 6.x - Unauthenticated Server-Side Request Forgery Author: LiquidWorm Product web page: https://www.inim.biz Link:...