CVE-2018-18991

SpiderControl SCADA WebServer (versions prior to 2.03.0001) is affected by CVE-2018-18991: a reflected cross-site scripting (non-persistent) flaw caused by improper input neutralization during web page generation. An attacker can craft a URL to execute JavaScript in a victim’s browser. Mitigation...

CVE-2018-18991: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting non-persistent in SCADA WebServer Versions prior to 2.03.0001 could allow an attacker to send a crafted URL that contains JavaScript, which can be reflected off the web application to the victim's browser...

PT-2018-14755

Name of the Vulnerable Software and Affected Versions SCADA WebServer versions prior to 2.03.0001 Description The issue allows an attacker to send a crafted URL containing JavaScript, which can be reflected off the web application to the victim's browser, potentially leading to cross-site scripti...

SpiderControl SCADA WebServer

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SpiderControl Equipment: SCADA WebServer Vulnerability: Reflected Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute JavaScript...

Directory Traversal

takeapeek is vulnerable to directory traversal. A remote attacker is able to exploit the vulnerability using the ../ characters to retrieve directory and files which are otherwise not available from the webserver...

WordPress sermon-shortcodes 1.0 Arbitrary File Download

Exploit Title : WordPress sermon-shortcodes 1.0 Plugins Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 27/11/2018 Vendor Homepage : wordpress.org sermonmanager.pro...

WordPress allow-l10n-upload-filename 1.0 Arbitrary File Download

Exploit Title : WordPress allow-l10n-upload-filename 1.0 Plugins Arbitrary File Download Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 27/11/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Category : WebApps Exploit Risk : Low...

Redirection Vulnerability Open in Multiple Siemens Products

Siemens SIMATIC HMI Comfort Panels and so on are used to control and monitor the HMI software of machines and equipment of Siemens Siemens Company of Germany. An open redirect vulnerability exists in the webserver of several Siemens products, which can be exploited by an attacker to redirect user...

Shell In A Box 2.2.0 Denial Of Service

Product: Shell In A Box aka shellinabox, shellinaboxd "Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugin...

WAGO 750-881 01.09.18 - Cross-Site Scripting

WAGO 750-881 01.09.18 - Cross-Site Scripting Exploit Title: WAGO 750-881 01.09.18 - Cross-Site Scripting Date: 2018-08-30 Exploit Author: SecuNinja @secuninja Vendor Homepage: wago.com Version: 01.09.1813 and earlier Affected Products: Ethernet Controller 750-881 - 01.09.1813, 01.08.01 10 CVE : N...

Intel Rapid Web Server webserver component information disclosure vulnerability

Intel Rapid Web Server is a rapid storage server from Intel Corporation. webserver is one of the web server components. A security vulnerability exists in the webserver component of Intel Rapid Web Server version 3. An attacker can exploit this vulnerability by accessing the network to obtain...

CVE-2018-12161

Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose information via network access...

CVE-2018-12161

CVE-2018-12161 affects Intel Rapid Web Server 3 webserver component. The issue is insufficient session validation that may allow an unauthenticated user to disclose information over the network. Affected product: Intel Rapid Web Server 3 webserver component. Impact: information disclosure with ne...

PT-2018-11041

Name of the Vulnerable Software and Affected Versions Intel Rapid Web Server 3 affected versions not specified Description The issue is related to insufficient session validation in the webserver component, which may allow an unauthenticated user to disclose information via network access...

CVE-2018-12161: Exposure of Sensitive Information to an Unauthorized Actor

Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose information via network access...

Unrestricted file upload

The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable co...

PT-2018-16946

Name of the Vulnerable Software and Affected Versions Auto-Maskin DCU-210E versions prior to 3.7 Auto-Maskin RP-210E versions prior to 3.7 Marine Pro Observer Android App versions prior to 3.7 Description The issue concerns the use of an embedded webserver that transmits the administrator PIN in...

[20190202] - Core - Browserside mime-type sniffing causes XSS attack vectors

A combination of specific webserver configurations, in connection with specific file types and browserside mime-type sniffing causes a XSS attack vector...

Click It Up: Targeting Local Government Payment Portals

FireEye has been tracking a campaign this year targeting web payment portals that involves on-premise installations of Click2Gov. Click2Gov is a web-based, interactive self-service bill-pay software solution developed by Superion. It includes various modules that allow users to pay bills associat...

CVE-2018-17178

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands sent to /bin/webserver on port 8081 if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though th...