SpotMSN 2.4.6 Denial Of Service

Exploit Title: SpotMSN 2.4.6 - 'Name/Key' Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-12 Vendor Homepage: www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/spotmsnsetup.exe Tested Version: 2.4.6 Tested on: Windows Windows 10 Single Language x64 /...

FrontAccounting SQL Injection Vulnerability

FrontAccounting FA is FrontAccounting's suite of financial software for the ERP supply chain of small and medium-sized businesses. The software includes modules for Purchase Orders, Merchandise Tickets, and Account Sorting and Budgeting. A SQL injection vulnerability exists in the...

Jinjava calls getClass

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2017-18287

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST usersearch parameter...

CVE-2017-18289

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter...

Sql injection

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST usersearch parameter...

Sql injection

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

CVE-2017-18290

CVE-2017-18290 affects PvPGN Stats 2.4.6. A SQL injection flaw exists in ladder/stats.php exploitable via the GET sort_direction parameter, enabling access to the PvPGN database (including emails, usernames, and passwords per CNVD). CVSS: 2.0/3.0 indicate high/critical impact on confidentiality, ...

CVE-2017-18290

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

CVE-2017-18287

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST usersearch parameter...

CVE-2014-0594

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

Cross site request forgery (csrf)

In the Open Build Service OBS before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent...

CVE-2018-11359

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference...

UBUNTU-CVE-2018-11359

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference...

OpenVPN Memory Double Release Vulnerability

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

Wireshark 2.2.x < 2.2.14 / 2.4.x < 2.4.6 Multiple Vulnerabilities (MacOS)

The version of Wireshark installed on the remote MacOS/MacOSX host is 2.2.x prior to 2.2.14 or 2.4.x prior to 2.4.6. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108884; scriptversion"1.8";...

Heap overflow

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs...

Atlassian Sourcetree for Windows Command Injection Vulnerability

Atlassian Sourcetree for Windows is a free Windows-based Git and Mercurial client tool from the Australian company Atlassian that manages repositories using a visual interface. A security vulnerability exists in Atlassian Sourcetree for Windows versions 0.5.1.0 through 2.4.7.0 excluding version...