Monthly Archive: April 2018

Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls. Date published : 2018-04-20 https://www.paessler.com/prtg/history/preview https://www.exploit-db.com/exploits/44500/

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search. Date published : 2018-04-20 https://github.com/idreamsoft/iCMS/issues/22

baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. Date published : 2018-04-20 https://crayon-xin.github.io/2018/04/20/baijiacmsV3-CSRF-add-admin/

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. Date published : 2018-04-20 https://github.com/wuzhicms/wuzhicms/issues/130

A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack...

bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected component is bacserv BACnet/IP BVLC forwarded NPDU. The function...

An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root directory of the web server. This vulnerability...

Digital Guardian Management Console 7.1.2.0015 has a Directory Traversal issue. Date published : 2018-04-20 http://packetstormsecurity.com/files/147242/Digital-Guardian-Management-Console-7.1.2.0015-Arbitrary-File-Read.html

Digital Guardian Management Console 7.1.2.0015 has an XXE issue. Date published : 2018-04-20 http://packetstormsecurity.com/files/147261/Digital-Guardian-Management-Console-7.1.2.0015-XXE-Injection.html

Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur...

Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. Date published : 2018-04-20 http://packetstormsecurity.com/files/147244/Digital-Guardian-Management-Console-7.1.2.0015-Shell-Upload.html

Geist WatchDog Console 3.2.2 uses a weak ACL for the C:ProgramDataWatchDog Console directory, which allows local users to modify configuration data by updating (1) config.xml or (2) servers.xml. Date published : 2018-04-20 https://www.exploit-db.com/exploits/44493/ http://packetstormsecurity.com/files/147253/Geist-WatchDog-Console-3.2.2-XSS-XML-Injection-Insecure-Permissions.html

Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description. Date published : 2018-04-20 https://www.exploit-db.com/exploits/44493/ http://packetstormsecurity.com/files/147253/Geist-WatchDog-Console-3.2.2-XSS-XML-Injection-Insecure-Permissions.html

XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data. Date published : 2018-04-20 https://www.exploit-db.com/exploits/44493/ http://packetstormsecurity.com/files/147253/Geist-WatchDog-Console-3.2.2-XSS-XML-Injection-Insecure-Permissions.html