Information disclosure

An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame...

Sql injection

An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to inject packets that could potentially disrupt the availabili...

Enterprise Edition Payment Processor Script 3.7 - SQL Injection

Enterprise Edition Payment Processor Script 3.7 - SQL Injection Exploit Title: Enterprise Edition Payment Processor Script 3.7 - SQL Injection Dork: N/A Date: 14.09.2017 Vendor Homepage: https://www.goterhosting.com/ Software Link: https://www.goterhosting.com/payment-processor-script.php Demo:...

Oracle Hospitality Suites Management Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hospitality management from Oracle Corporation. The solution provides human resources cost management, provide customer service throughout the journey tracking management to improve customer...

Banco Santander Mexico SA Supermovil app for iOS Information Disclosure Vulnerability

Banco Santander Mexico SA Supermovil app for iOS is an iOS-based mobile application from Banco Santander Mexico SA with quick access to manage your bank account, manage balances, pay bills and send money. A security vulnerability exists in versions 3.5 through 3.7 of the Banco Santander Mexico SA...

Banco de Costa Rica BCR Movil app for iOS Man-in-the-Middle Attack Vulnerability

Banco de Costa Rica BCR Movil app for iOS is a mobile app for iOS from Banco de Costa Rica with quick access to manage your bank account, manage your balances, pay bills and send money. A security vulnerability exists in version 3.7 of the Banco de Costa Rica BCR Movil app for iOS-based platforms...

Joomla! 3.7.x < 3.7.1 fields.php getListQuery() Method SQLi

According to its self-reported version number, the Joomla! installation running on the remote web server is 3.7.x prior to 3.7.1. It is, therefore, affected by a SQL injection vulnerability in the fields.php script due to improper sanitization of user-supplied input. An unauthenticated, remote...

Sql injection

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-8917

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-5911

The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2017-10091

Name of the Vulnerable Software and Affected Versions Moxa NPort 5110 versions prior to 2.6 Moxa NPort 5130/5150 Series versions prior to 3.6 Moxa NPort 5200 Series versions prior to 2.8 Moxa NPort 5400 Series versions prior to 3.11 Moxa NPort 5600 Series versions prior to 3.7 Moxa NPort 5100A...

CVE-2016-8328

Vulnerability in the Java SE component of Oracle Java SE subcomponent: Java Mission Control. The supported version that is affected is Java SE: 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful...

Adobe Connect / Desktop 9.5.7 Script Insertion

Document Title: =============== Adobe Connect & Desktop v9.5.7 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1838 Security ID: PSIRT-5180 Bulletin: https://helpx.adobe.com/security/products/connect/apsb16-35.html...

ETchat 3.7 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: ETchatpersian version CMS Xsrf vulnerability Exploit Author: Hesam Bazvand Contact: https://www.facebook.com/hesam.king73 Software Link: http://dl.20script.ir/script/chat/et-chat-3.7-Persianwww.20script.ir.zip Tested on: Windows...

ETchat 3.7 Cross Site Request Forgery

Exploit Title: ETchatpersian version CMS Xsrf vulnerability Exploit Author: Hesam Bazvand Contact: https://www.facebook.com/hesam.king73 Software Link: http://dl.20script.ir/script/chat/et-chat-3.7-Persianwww.20script.ir.zip Tested on: Windows 7 / Kali Linux Category: WebApps Dork : User Your Min...

Denial of Service Vulnerability in Hitman Pro 3.7

Hitman Pro is an anti-spyware virus program. A denial of service vulnerability exists in Hitman Pro 3.7. In the driver for Hitman Pro 3.7, the driver's buffer pointer passed in from the application layer after calling DeviceIoControl is not tested to see if memory space is claimed, resulting in a...

Stored Cross-Site Scripting Vulnerability in Knight CMS Version 3.7

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. A stored cross-site scripting vulnerability exists in Knight CMS version 3.7. Because the editor in KindEditor version 4.1.10 fails to filter input content, an attacker can exploit the vulnerability to execute arbitrary...

Saveya Script Insertion

Document Title: =============== Saveya Bounty 1 - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1857 SaveYa ID: 56 Acknowledgements: https://www.saveya.com/white-hat-program-acknowledgements Release Date: =============...

Trend Micro Deep Discovery Inspector RCE Vulnerability

Trend Micro Deep Discovery Inspector is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Design/Logic Flaw

hotfixupload.cgi in Trend Micro Deep Discovery Inspector DDI 3.7, 3.8 SP1 3.81, and 3.8 SP2 3.82 allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header...