g-disk.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-634145 Description| Value ---|--- Affected Website:| g-disk.co.kr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: Multiple vulnerabilities has been identified in Jackson JSON library shipped with IBM Tivoli Netcool/OMNIbus Integrations Transport Module Common Integration Library (CVE-2017-17485, CVE-2018-5968, CVE-2018-7489)

Summary Jackson JSON library is shipped as a component of IBM Tivoli Netcool/OMNIbus Integrations Transport Module Common Integration Library. Information about security vulnerabilities affecting Jackson JSON library has been published. The Netcool/OMNIbus Transport Module Common Integration...

Man-in-the-Middle (MitM)

install-g-test is vulnerable to man-in-the-middle MitM attacks. This is because they download binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on th...

CVE-2016-10630

install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2016-10630

CVE-2016-10630 affects the install-g-test package, where resources are downloaded over HTTP, enabling man-in-the-middle interception. The available connected documents consistently describe MITM risk and, in several advisories, note that no patch is currently available; mitigation is to avoid the...

CVE-2016-10630: Missing Encryption of Sensitive Data

install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

PT-2018-4808

Name of the Vulnerable Software and Affected Versions install-g-test versions affected versions not specified Description The issue concerns the insecure download of resources over HTTP, making it susceptible to Man-In-The-Middle MITM attacks. In such attacks, an adversary with a privileged netwo...

g-trema.ch XSS vulnerability

Open Bug Bounty ID: OBB-620352 Description| Value ---|--- Affected Website:| g-trema.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

g-langue-de-bois.fr XSS vulnerability

Open Bug Bounty ID: OBB-611766 Description| Value ---|--- Affected Website:| g-langue-de-bois.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Adaltech G-Ticket SQL Injection Vulnerability

Adaltech G-Ticket is a ticket validation system. A SQL injection vulnerability exists in Adaltech G-Ticket version 70 EME104. A remote attacker can exploit this vulnerability by sending the 'evecod' parameter to the mobile-loja/mensagem.asp file to execute SQL commands...

Sql injection

Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp evecod parameter...

CVE-2018-10284

Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp evecod parameter...

CVE-2018-10284

Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp evecod parameter...

CVE-2018-10284

Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp evecod parameter...

CVE-2018-10284

Affected software: Adaltech G-Ticket v70 EME104. Vulnerable component: mobile-loja/mensagem.asp, parameter eve_cod . Root cause: SQL Injection due to unvalidated input. Impact: enables execution of arbitrary SQL commands (as stated in sources), with high severity in CVSS metrics. Exploitation det...

CVE-2018-10284: Improper Neutralization of Special Elements used in an SQL Command

Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp evecod parameter...

PT-2018-9800

Name of the Vulnerable Software and Affected Versions: Adaltech G-Ticket version v70 EME104 Description: The issue is related to SQL Injection, which can be exploited via the eve cod parameter in the "mobile-loja/mensagem.asp" endpoint. Recommendations: For Adaltech G-Ticket version v70 EME104,...

PT-2018-9698

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.5 Description: An issue was discovered that allows CSRF via an "index.php?g=Manage&m=Rbac&a=addUser" request, resulting in the addition of an account with the administrator role. Recommendations: For XYHCMS version 3.5,...

CVE-2018-10127: Cross-Site Request Forgery (CSRF)

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role...

Command injection

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...