Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter “filename” properly. Exploitation requires a registered user who has access to upload functionality.
IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root access. IBM X-Force ID: 123741.
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118540.
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not prevent a change of a file extension to “.php” after originally using the parameter “filename” for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. IBM X-Force ID: 122293.
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow the attacker to read any file on the system. IBM X-Force ID: 118538.
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized users. IBM X-Force ID: 118539.
[DISCLAIMER: So far, the exploit hasnt worked for me. But I am outside of the office, and do not have access to my usual tools. Please let us know if you have any additional details] Shadowbroker, as part of the set of exploits it collected and had offered for auction, today released a number of …
Read more “ETERNALBLUE: Possible Window SMB Buffer Overflow / 0-Day, (Fri, Apr 14th)”
Moxa MXView 2.8 allows remote attackers to read web server’s private key file, no access control.
Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program.