jsp

dizqueTV 1.5.3 – Remote Code Execution (RCE)

# Exploit Title: dizqueTV 1.5.3 - Remote Code Execution (RCE)

BMC Compuware iStrobe Web – 20.13 – Pre-auth RCE

#!/usr/bin/env python3

STARFACE 7.3.0.10 – Authentication with Password Hash Possible

Exploit Title: STARFACE 7.3.0.10 - Authentication with Password Hash Possible

Pentaho BA Server EE 9.3.0.0-428 – Remote Code Execution (RCE) (Unauthenticated)

# Exploit Title: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

ZKTeco ZEM/ZMM 8.88 – Missing Authentication

# Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication

Desktop Central 9.1.0 – Multiple Vulnerabilities

# Exploit Title: Desktop Central 9.1.0 - Multiple Vulnerabilities

Openfire 4.6.0 – ‘sql’ Stored XSS

# Exploit Title: Openfire 4.6.0 - 'sql' Stored XSS

Openfire 4.6.0 – ‘users’ Stored XSS

# Exploit Title: Openfire 4.6.0 - 'users' Stored XSS

Openfire 4.6.0 – ‘groupchatJID’ Stored XSS

# Exploit Title: Openfire 4.6.0 - 'groupchatJID' Stored XSS

Openfire 4.6.0 – ‘path’ Stored XSS

# Exploit Title: Openfire 4.6.0 - 'path' Stored XSS

Atlassian Confluence 6.15.1 – Directory Traversal (Metasploit)

# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)

Atlassian Confluence 6.15.1 – Directory Traversal

# Exploit Title: Atlassian Confluence 6.15.1 - Directory Traversal

NetGain EM Plus 10.1.68 – Remote Command Execution

# Exploit Title: NetGain EM Plus

Ahsay Backup 7.x – 8.1.1.50 – XML External Entity Injection

# Unauthenticated XML External Entity (XXE) in Ahsay Backup v7.x - v8.1.0.50.

Ahsay Backup 7.x – 8.1.1.50 – Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit)

# Exploit Title: Authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. (Metasp...

Ahsay Backup 8.1.1.50 – Insecure File Upload and Code Execution (Authenticated)

# Exploit Title: Ahsay Backup 8.1.1.50 - Insecure File Upload and Code Execution (Authenticated)

Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API – Cross-Site Scripting

# Exploit Title: Liferay Portal < 7.1 CE GA4 / SimpleCaptcha API XSS

Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery

#coding=utf8

dotCMS 5.1.1 – HTML Injection

# Exploit Title: dotCMS 5.1.1 - HTML Injection

Manage Engine ServiceDesk Plus 10.0 – Privilege Escalation

#!/usr/bin/python

OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)

##

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 – Path Traversal / Cross-Site Scripting

Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload

# Exploit Title: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 - arbitrary file upload

Microstrategy Web 7 – Cross-Site Scripting / Directory Traversal

Sophos Cyberoam UTM CR25iNG – 10.6.3 MR-5 – Direct Object Reference

# Exploit Title: Sophos Cyberoam UTM - Privilege Escalation

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) – Multiple Vulnerabilities

Core Security - Corelabs Advisory

Oracle E-Business Suite 12.1.3/12.2.x – Open Redirect

# Exploit Title: Oracle E-Business suite Open Redirect

Gespage 7.4.8 – SQL Injection

# [CVE-2017-7997] Gespage SQL Injection vulnerability

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)

#!/usr/bin/python

OpenText Document Sciences xPression 4.5SP1 Patch 13 – ‘documentId’ SQL Injection

Title: OpenText Document Sciences xPression (formerly EMC Document

OpenText Document Sciences xPression 4.5SP1 Patch 13 – ‘jobRunId’ SQL Injection

Title: OpenText Document Sciences xPression (formerly EMC Document

Infinite Automation Mango Automation – Command Injection (Metasploit)

require 'msf/core'

Symantec Messaging Gateway 10.6.3-2 – Root Remote Command Execution

This is an advisory for CVE-2017-6327 which is an unauthenticated remote

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Server-Side Request Forgery

DALIM SOFTWARE ES Core 5.0 build 7184.1 Server-Side Request Forgery

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Directory Traversal

DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Remote File Disclosures

DALIM SOFTWARE ES Core 5.0 build 7184.1 – Cross-Site Scripting / Cross-Site Request Forgery

DALIM SOFTWARE ES Core 5.0 build 7184.1 – User Enumeration

#!/usr/bin/env python

Advantech SUSIAccess < 3.0 - 'RecoveryMgmt' File Upload

#!/usr/bin/env ruby

Advantech SUSIAccess < 3.0 - Directory Traversal / Information Disclosure (Metasploit)

require 'msf/core'

Oracle E-Business Suite 12.x – Server-Side Request Forgery

# Exploit Title: Oracle E-Business Suite - Server Side Request Forgery

NetGain EM 7.2.647 build 941 – Authentication Bypass / Local File Inclusion

'''

Oracle E-Business Suite 12.2.3 – ‘IESFOOTPRINT’ SQL Injection

Application: Oracle E-Business Suite

Nuxeo 6.0/7.1/7.2/7.3 – Remote Code Execution (Metasploit)

=begin

Kinsey Infor/Lawson / ESBUS – SQL Injection

##################################################################

NetGain Enterprise Manager 7.2.562 – ‘Ping’ Command Injection

# Exploit Title: NetGain Enterprise Manager – “Ping” Command Injection

Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting

=====[ Tempest Security Intelligence - ADV-3/2016 CVE-2016-6283 ]==============

ZKTeco ZKAccess Security System 5.3.1 – Persistent Cross-Site Scripting

alert(1)" />

ZKTeco ZKBioSecurity 3.0 – ‘visLogin.jsp’ Local Authentication Bypass

ZKTeco ZKBioSecurity 3.0 (visLogin.jsp) Local Authorization Bypass

ZKTeco ZKBioSecurity 3.0 – Directory Traversal

ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability

ZKTeco ZKBioSecurity 3.0 – Cross-Site Request Forgery (Add Superadmin)