CVE-2018-6860

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture...

CVE-2018-6860

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture...

CVE-2018-6863

CVE-2018-6863 affects PHP Scripts Mall’s “Select Your College Script” version 2.0.2. The vulnerability is a SQL injection in the login parameter, allowing an attacker to manipulate SQL queries executed by the login flow. Public sources describe a remote exploit path that leads to authentication b...

Entrepreneur Dating Script 2.0.2 - Authentication Bypass

Entrepreneur Dating Script 2.0.2 - Authentication Bypass Exploit Title: Entrepreneur Dating Script 2.0.2 - Authentication Bypass Dork: N/A Date: 2018-02-07 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

Entrepreneur Dating Script 2.0.2 - Authentication Bypass

Exploit Title: Entrepreneur Dating Script 2.0.2 - Authentication Bypass Dork: N/A Date: 2018-02-07 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage: https://www.phpscriptsmall.com/product/entrepreneur-dating-script/ Version: 2.0.2 Category: Webapps CVE: N/A...

CVE-2018-6188

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...

Node.js third-party modules: [html-janitor] Bypassing sanitization using DOM clobbering

Module: Name: html-janitor Version: 2.0.2 Summary: Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous XSS in case user-controlled input is passed to the clean function. Description: Proof of concept: javascript var myJanitor = new HTMLJanitortags:p:; var...

Change Healthcare Conserus Workflow Intelligence Authentication Bypass Vulnerability

Change Healthcare Conserus Workflow Intelligence application is a diagnostic imaging workflow application for hospitals and health systems from Change Healthcare, USA. An authentication bypass vulnerability exists in the Change Healthcare Conserus Workflow Intelligence application version 2.0.2. ...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-09515)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-09514)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

HE-AAC+ Codec aacplusenc.c File Denial of Service Vulnerability

HE-AAC+ Codec aka libaacplus is a library that provides audio codecs. A security vulnerability exists in the aacplusenc.c file in HE-AAC+ Codec version 2.0.2. A remote attacker could exploit this vulnerability to cause a denial of service application crash via a specially crafted audio file...

CVE-2017-7605

CVE-2017-7605 affects HE-AAC+ Codec (libaacplus) 2.0.2, with an assertion failure in aacplusenc.c that could allow a crafted audio file to cause a denial of service (application crash). Connected sources confirm the same issue and note related 7603/7604 variants exist in the same library. No publ...

CVE-2017-7604

auchannel.h in HE-AAC+ Codec aka libaacplus 2.0.2 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted audio file...

PT-2017-17834 · Fraunhofer Iis · He-Aac+ Codec

Name of the Vulnerable Software and Affected Versions: HE-AAC+ Codec aka libaacplus version 2.0.2 Description: The issue is related to a signed integer overflow in the au channel.h file, which could allow remote attackers to cause a denial of service, resulting in an application crash, or possibl...

MantisBT Source Integration Cross-Site Scripting Vulnerability

MantisBT is MantisBT team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations . Source Integration is one of the source code control integration plug-in . A cross-site scripting vulnerability exists ...

CUPS Remote Code Execution

!/usr/bin/python Exploit Title: CUPS Reference Count Over Decrement Remote Code Execution Google Dork: n/a Date: 2/2/17 Exploit Author: @0x00string Vendor Homepage: cups.org Software Link: https://github.com/apple/cups/releases/tag/release-2.0.2 Version: \n" " -h, --help: Show this message\n" " -...

CVE-2015-2868

An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting...

IBM Security Privileged Identity Manager Authentication Bypass Vulnerability

IBM Security Privileged Identity Manager is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM USA, that protects, automates, and audits the use of privileged identities to help defend against insider threats and improve security...

CVE-2016-1581

LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors...

Wireshark IEEE 802.11 parser denial of service vulnerability (CNVD-2016-02770)

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. A denial of service vulnerability exists in the epan/dissectors/packet-ieee80211.c file in the IEEE 802.11 parser in versions 2.x prior to Wireshark 2.0.2. A remote attacker can...