Fabio Cogno

5 exploits Active since Feb 2019
CVE-2019-8903 METASPLOIT HIGH ruby WORKING POC
Total.js prior to 3.2.4 Directory Traversal
index.js in Total.js Platform before 3.2.3 allows path traversal.
CVSS 7.5
CVE-2019-10867 METASPLOIT HIGH ruby WORKING POC
Pimcore < 5.7.1 - Insecure Deserialization
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
CVSS 8.8
CVE-2019-9692 METASPLOIT MEDIUM ruby WORKING POC
CMSMS <2.2.10 - Info Disclosure
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
CVSS 6.5
CVE-2019-9692 EXPLOITDB MEDIUM ruby WORKING POC
CMSMS <2.2.10 - Info Disclosure
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
CVSS 6.5
CVE-2019-10867 EXPLOITDB HIGH ruby WORKING POC
Pimcore < 5.7.1 - Insecure Deserialization
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
CVSS 8.8