This archive contains all of the 181 exploits added to Packet Storm in April, 2018.
bc3719c08cc1b48d37e0b2a45f2437d2d9cb917f0865186bbb585f00e5fb6bc8Nagios XI versions 5.2.6 up to 5.2.9, 5.3, and 5.4 chained remote root exploit.
bb9a9ca26635c2779d5e4662eab43b6b113e781b49058727e94049827cb3f59aA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site Which could result in the site being compromised.
b0abf565098b8777e0d1cb55c10243c19f5eca120fbd94d0bd859d9183c69fedWordPress Form Maker plugin version 1.12.20 suffers from a CSV injection vulnerability.
d3433e864efed7826544d650bf5577a79699c12863a7bbc9bd00e952b50c4c2dCockpit CMS versions 0.4.4 through 0.5.5 suffer from a server-side request forgery vulnerability.
877fb3147fad9053c21d2ae76bcbba82752af4be9b3e9a70fa171c8a6b4a756eBlackboard Learn suffers from an open redirection vulnerability.
babf5d4124d851a4e9d66c658de82f2eca5512ae3986075bd6ee247d9c1f3cd9Test Your IQ version 1.1 suffers from a remote SQL injection vulnerability.
a29c97213b587870f1a5a4337f9f37c2bde8036f8ff2c0bcb06223176c8044f5Frog CMS version 0.9.5 suffers from a persistent cross site scripting vulnerability.
27e5740009e2c00b14ca3eed6da446e7f27908f8557acdab701bcf00d0b42f39Navicat versions prior to 12.0.27 suffer from an oracle connection overflow vulnerability.
8d035b1e096be2a42ad3e4c182c90e91021be26b95e6eb871a04a9cc4a24f909TP-Link Technologies TL-WA850RE Wi-Fi Range Extender suffers from an unauthorized remote reboot vulnerability.
970a5397e04acea93596c1622e954fa7cc0a100eb23d4a5bf1fa9ecac096aba5This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable.
d8e06fe66e7a7c70257d472a150741719f1392fb6c548c25bee9d61d4f3a78cdGitList version 0.6 unauthenticated remote code execution exploit.
0dd6d31c236e339ea46cf2a96afd06f86a7c41ebbaa4e592b132cc48869c6f13Google Chrome V8 Await methods call ResolveNativePromise which calls InternalResolvePromise which can invoke a user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.
78b2c24ff6a8f61df29a3ac781ec2f32f86061d57afb7512f75393705b8644f1HRSALE The Ultimate HRM version 1.0.2 suffers from a cross site scripting vulnerability.
8dbe06a437c757977d1e7e6fff47c5afc2c86bf0606b007b7b8ec40b4dc8df01HRSALE The Ultimate HRM version 1.0.2 suffers from a local file inclusion vulnerability.
5772c8ea23208440a6468e45bb2ba8d98e1bb327e63a9e3a03be53512f1a46d0This is a simple proof of concept exploit for Drupal versions prior to 7.58 that demonstrate the drupalgeddon3 authenticated remote code execution vulnerability.
083d892c5eba86d29cd75e8b8e8af90103d767eb04a11f57033b9dd9088214a0Jfrog Artifactory versions prior to 4.16 suffer from unauthenticated arbitrary file upload and remote command execution vulnerabilities.
152a825b4c3e4e8481acf58c79f6c1d359fdb42bc26f7d136ab8976ae360c2d7WordPress WP with Spritz plugin version 1.0 suffers from local and remote file inclusion vulnerabilities.
c6986cfbd78a92dae5c9a05da5db76c918141c17da17231a3ab998a61b73258dSickRage versions prior to 2018.03.09 return clear-text credentials in HTTP responses.
4eca74b6076c68ef8dfaed89847067aaacb96f5e62b6e0dd9c02340a7fcaca16October CMS User plugin version 1.4.5 suffers from a persistent cross site scripting vulnerability.
2542351c0db2686c16ac211c741d58a6096bc2da3e0f49b94409072994f16c19A lack of validation on cookie values allows you to login as any user on hik-connect.com and ezvizlife.com.
640d9d5b8ed635a745527703397776a5bb9f02ecdcb9b198beddb96116636e81Sitecore.NET version 8.1 suffers from a directory traversal vulnerability.
e4a706da6b29b62366f1ed365cb9f34fa7a8c59a749e0d003d626c959eb95de6HRSALE The Ultimate HRM version 1.0.2 suffers from a remote SQL injection vulnerability.
59325a4cf4859ff56febfa34f3bbcd6b4a95112c26ef20b9ab6610f87c0822b2HRSALE The Ultimate HRM version 1.0.2 suffers from a CSV injection vulnerability.
1687a963043763348cd13d727463d2d3beb849e67926c5d0b6a37617f97f7773Blog Master Pro version 1.0 suffers from a CSV injection vulnerability.
f7fc3381ec61ed7adcf8a5a10586722b9f109264dc4e27d6d064e9358cb059a3
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed