CVE-2015-2184
published 2015-03-10CVE-2015-2184: ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
PriorityP337medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
8.40%
94.3th percentile
ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ajsquare | zeuscart | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Linux Kernel 3.10.0-229.x (CentOS / RHEL 7.1) - 'snd-usb-audio' Crash (PoC)
exploitdb·2016-03-14
CVE-2016-2184 Linux Kernel 3.10.0-229.x (CentOS / RHEL 7.1) - 'snd-usb-audio' Crash (PoC)
Linux Kernel 3.10.0-229.x (CentOS / RHEL 7.1) - 'snd-usb-audio' Crash (PoC)
---
OS-S Security Advisory 2016-17
Linux snd-usb-audio Multiple Free
Date: March 4th, 2016
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg
CVE: not yet assigned
CVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Title: Local RedHat Enterprise Linux DoS â?? RHEL 7.1 Kernel crashes (multiple
free) on invalid USB device descriptors (snd-usb-audio driver)
Severity: Critical. The Kernel panics. A reboot is required.
Ease of Exploitation: Trivial
Vulnerability type: Wrong input validation
Products: RHEL 7.1 including all updates
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 (for debugging-purposes we used the
CentOS Kernel kernel-debuginfo-3.10.0-229.14.1.el7)
Vendor: Red Hat
Vendor contacted: November, 12th 2015
PDF of
Exploit-DB
Zeuscart 4.0 - Multiple Vulnerabilities
exploitdb·2015-02-23
CVE-2015-2184 Zeuscart 4.0 - Multiple Vulnerabilities
Zeuscart 4.0 - Multiple Vulnerabilities
---
Advisory: Multiple reflecting XSS-, SQLi and
InformationDisclosure-vulnerabilities in Zeuscart v.4
Advisory ID: SROEADV-2015-12
Author: Steffen Rösemann
Affected Software: Zeuscart v.4
Vendor URL: http://zeuscart.com/
Vendor Status: pending
CVE-ID: will asked to be assigned after release on FullDisclosure via
OSS-list
Software used for research: Mac OS X 10.10, Firefox 35.0.1
Vulnerability Description:
ECommerce-Shopping Cart Zeuscart v. 4 suffers from multiple XSS-, SQLi- and
InformationDisclosure-vulnerabilities.
Technical Details:
====
XSS
===
Reflecting XSS-vulnerabilities can be found in a common
Zeuscart-installation in the following locations and could be exploited for
example by crafting a link and make a registered user click on t
http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Feb/89http://seclists.org/oss-sec/2015/q1/649http://seclists.org/oss-sec/2015/q1/727http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.htmlhttp://www.exploit-db.com/exploits/36159http://www.securityfocus.com/bid/72761https://github.com/ZeusCart/zeuscart/issues/28http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Feb/89http://seclists.org/oss-sec/2015/q1/649http://seclists.org/oss-sec/2015/q1/727http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.htmlhttp://www.exploit-db.com/exploits/36159http://www.securityfocus.com/bid/72761https://github.com/ZeusCart/zeuscart/issues/28
2015-03-10
Published