Linux Home Folder Accessible (HTTP)

The script attempts to identify files of a linux home folder accessible at the webserver. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-late...

http-mcmp NSE Script

Checks if the webserver allows modcluster management protocol MCMP methods. The script sends a MCMP PING message to determine protocol support, then issues the DUMP command to dump the current configuration seen by modclustermanager. References: Script Arguments slaxml.debug See the documentation...

SugarCRM REST Unserialize PHP Code Execution

This module exploits a PHP Object Injection vulnerability in SugarCRM CE use exploit/unix/webapp/sugarcrm/restunserializeexec msf undefinedrestunserializeexec show actions ...actions... msf undefinedrestunserializeexec set ACTION msf undefinedrestunserializeexec show options ...show and set...

WordPress Plugin Simple Backup 2.7.11 - Multiple Vulnerabilities

WordPress Plugin Simple Backup 2.7.11 - Multiple Vulnerabilities Meta information Exploit Title: Wordpress plugin simple-backup - Multiple vulnerabilities Date: 2016-06-02 Exploit Author: PizzaHatHacker A gmail . com Vendor Homepage: DEAD LINK https://wordpress.org/plugins/simple-backup/ Software...

WordPress Simple Backup 2.7.11 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Meta information Exploit Title: Wordpress plugin simple-backup - Multiple vulnerabilities Date: 2016-06-02 Exploit Author: PizzaHatHacker A gmail . com Vendor Homepage: DEAD LINK https://wordpress.org/plugins/simple-backup/ Software Link: DEAD...

WordPress Simple Backup Plugin 2.7.11 - Multiple Vulnerabilities

Simple Backup plugin is prone to multiple vulnerabilities, such as arbitrary file deletion and file download vulnerabilities. Because of these issues, an attacker can download remote files from the webserver delete arbitrary files without any authentication and permission. Solution Update the...

FreeBSD : phpmyadmin -- XSS and sensitive data leakage (00ec1be1-22bb-11e6-9ead-6805ca0b3d42)

The phpmyadmin development team reports : Description Because user SQL queries are part of the URL, sensitive information made as part of a user query can be exposed by clicking on external links to attackers monitoring user GET query parameters or included in the webserver logs. Severity We...

Moneybird: information disclose

Researcher found a disclosure of the server version of our website. We have removed this information from our webserver responses...

小云wifi路由器默认webserver 代理服务未授权访问

No description provided by source...

phpmyfaq -- cross-site request forgery vulnerability

The phpMyFAQ team reports: The vulnerability exists due to application does not properly verify origin of HTTP requests in "Interface Translation" functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator...

Webserver Access Detection

Binary data 9178.prm...

Debian: Security Advisory (DSA-3489-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3489-1 (lighttpd - security update)

lighttpd, a small webserver, is vulnerable to the POODLE attack via the use of SSLv3. This protocol is now disabled by default. OpenVAS Vulnerability Test $Id: deb3489.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3489-1 using nvtgen 1.0 Script version: 1.0 Author:...

CVE-2016-2279

Cross-site scripting XSS vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L before 28.011+ allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Xymon Command Injection Vulnerability

Xymon is an open source , cross-platform network monitoring application . The application can be viewed through the web page of the operational status of each server , and supports Email and SMS notification function . Xymon's useradm and chpasswd web applications in the command injection...

Venom - Metasploit Shellcode Generator / Compiler / Listenner

The script will use msfvenom metasploit to generate shellcode in diferent formats c | python | ruby | dll | msi | hta-psh , injects the shellcode generated into one funtion example: python "the python funtion will execute the shellcode in ram" and uses compilers like: gcc gnu cross compiler or...

Paragon Initiative Enterprises: DNSsec not configured

Description: I found out that there is no DNSSEC configured on your webserver to prevent DNS related attacks. This is an issue that would allow attackers to target your DNS directly The Domain Name System Security Extensions DNSSEC is a suite of Internet Engineering Task Force IETF specifications...

Huawei VP9660信息泄露漏洞

VP9660是华为视频会议系统的多媒体控制单元。 华为VP9660产品存在服务端未对输入完全做校验的安全漏洞。在使用内置WebServer场景下, 攻击者以业务管理员身份登录到设备后，通过构造修改特定报文信息发送到服务端，可以注入恶意命令，从而导致信息泄露，设备不可用。 前提条件： 1. 攻击者能够以业务管理员身份登录VP9660成功； 2. VP9660在使用内置WebServer场景下存在该漏洞; 攻击步骤：...

Security Advisory - Input Validation Vulnerability in Huawei VP9660 Products

VP9660 is the multi-point control unit of Huawei Video Conference system. The server of the Huawei VP9660 does not validate the input when using build-in WebServer. In such case, an attacker could log in to the device as an business administrator, graft a message to change the specific informatio...

CVE-2004-1063

PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safemodeexecdir restrictions and execute commands outside of the intended safemodeexecdir via shell metacharacters in the current directory name. NOTE: this issue was...