1233 matches found
CVE-2020-24899
Nagios XI 5.7.2 is affected by a remote code execution RCE vulnerability. An authenticated user can inject additional commands into normal webapp query...
CVE-2020-24899
Nagios XI 5.7.2 is affected by a remote code execution RCE vulnerability. An authenticated user can inject additional commands into normal webapp query...
Remote code execution
Nagios XI 5.7.2 is affected by a remote code execution RCE vulnerability. An authenticated user can inject additional commands into normal webapp query...
CVE-2020-24899
Nagios XI 5.7.2 is affected by a remote code execution RCE vulnerability. An authenticated user can inject additional commands into normal webapp query...
Nagios XI和Nagios 命令注入漏洞
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A remote code execution vulnerability exists in Nagios XI 5.7.2. An attacker can exploit this vulnerability to inject commands into a...
h1-ctf: [H1 hackyholidays] CTF Writeup
Hello team, Here is my CTF writeup for HackyHolidays. Main page The main page doesn't contain any interesting stuff, just a few assets. Maybe we will find some known files in webapp root: index.php, .htaccess, robots.txt, ...? robots.txt file exists, and there is the first flag: User-agent:...
Apache Tapestry Information Disclosure (CVE-2020-13953)
An information disclosure vulnerability exists in Apache Tapestry. This vulnerability is due to URL manipulation that allows Java webapp files inside WEB-INF to be listed and downloaded...
CVE-2020-26954
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on...
CVE-2020-26954
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on...
Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
Exploit Title: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload Google Dork: inurl:''comgmapfp'' Date: 2020-03-27 Exploit Author: ThelastVvV Vendor Homepage: https://gmapfp.org/ Version:Version J3.5 /J3.5free Tested on: Ubuntu CVE: CVE-2020-23972 Description: An attacker can...
org.apache.camel:camel-web-standalone (>=2.0-M1 <=2.2.0), org.mortbay.hightide.example:auction (=6.1H.24) +16 more potentially affected by CVE-2020-27216 via org.mortbay.jetty:jetty-webapp (>=7.0.0.pre4 <=7.0.0.pre5)
org.mortbay.jetty:jetty-webapp MAVEN version =7.0.0.pre4, =2.0-M1, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre4, =7.0.0.pre5 and more Source cves: CVE-2020-27216 Source advisory: OSV:GHSA-G3WG-6MCF-8J...
Typesetter CMS 5.1 Remote Code Execution
Exploit Title: Typesetter CMS 5.1 - Arbitrary Code Execution Exploit Author: Rodolfo "t0gu" Tavares Contact: @t0guu TW Software Homepage: https://www.typesettercms.com/ Version : 5.1 Tested on: Linux / Apache Category: WebApp Google Dork: intext:"Powered by Typesetter" Date: 2020-09-29 CVE :...
Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated)
Exploit Title: Typesetter CMS 5.1 - Arbitrary Code Execution Exploit Author: Rodolfo "t0gu" Tavares Contact: @t0guu TW Software Homepage: https://www.typesettercms.com/ Version : 5.1 Tested on: Linux / Apache Category: WebApp Google Dork: intext:"Powered by Typesetter" Date: 2020-09-29 CVE :...
Textpattern CMS 4.6.2 - Cross-site Request Forgery
Exploit Title: Textpattern CMS 4.6.2 - Cross-site Request Forgery Exploit Author: Alperen Ergel Contact: @alprenae Software Homepage: https://textpattern.com/ Version : 4.6.2 Tested on: windows 10 / xammp Category: WebApp Google Dork: intext:"Published with Textpattern CMS" Date: 2020-10-29...
Liman 0.7 - Cross-Site Request Forgery (Change Password)
Exploit Title: Liman 0.7 - Cross-Site Request Forgery Change Password Date: 2020-10-07 Exploit Author: George Tsimpidas Software Link : https://github.com/salihciftci/liman/releases/tag/v0.7 Version: 0.7 Tested on: Ubuntu 18.04.5 LTS Bionic Beaver Category: Webapp Description: There is no CSRF...
Seat Reservation System 1.0 Cross Site Scripting
Exploit Title: Seat Reservation System 1.0 Persistent Cross-Site Scripting Date: 10-08-2020 Exploit Author: George Tsimpidas Vendor Homepage: www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php0.zip Version:...
Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
Exploit Title: Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting Exploit Author: Alperen Ergel Web Site: https://alperenae.gitbook.io/ Software Homepage: https://textpattern.com/ Version : 4.6.2 Tested on: windows 10 / xammp Category: WebApp Google Dork: intext:"Published with...
Textpattern CMS 4.6.2 Cross Site Scripting
Exploit Title: Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting Exploit Author: Alperen Ergel Web Site: https://alperenae.gitbook.io/ Software Homepage: https://textpattern.com/ Version : 4.6.2 Tested on: windows 10 / xammp Category: WebApp Google Dork: intext:"Published with...
Information Disclosure
tapestry-core is vulnerable to information disclosure. Mishandling of URL allows an attacker to use malicious URL to list and download the JAVA webapp files from WEB-INF of the WAR being run...
Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting
Exploit Title: Typesetter CMS 5.1 - 'Site Title' Persistent Cross-Site Scripting Exploit Author: Alperen Ergel Web Site: https://alperenae.gitbook.io/ Contact: @alperenae IG @alprenae TW Software Homepage: https://www.typesettercms.com/ Version : 5.1 Tested on: windows 10 / xammp Category: WebApp...