MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection

Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...

CVE-2018-18282

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

Cross site scripting

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

CVE-2018-18282

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

CVE-2018-18282

CVE-2018-18282 affects Next.js 7.0.0 and 7.0.1, introducing a cross-site scripting (XSS) vulnerability on the 404/500 pages via the /_error handler. The issue originates from how the pathname is sanitized, enabling a remote attacker to execute client-side code through crafted requests. A fix is a...

CVE-2018-18282

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /error page...

CVE-2018-17900

Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allow an attacker to obtain credentials for remote access to controllers...

CVE-2018-17896

CVE-2018-17896 affects Yokogawa STARDOM controllers FCJ, FCN-100, FCN-RTU, FCN-500 (versions R4.10 and earlier). The vulnerability stems from hard-coded credentials that could allow an attacker to gain unauthorized maintenance access and view/modify information, with exploitation possible during ...

CVE-2018-17898

CVE-2018-17898 affects Yokogawa STARDOM Controllers (FCJ, FCN-100, FCN-RTU, FCN-500) on R4.10 and earlier. The issue is memory exhaustion caused by unauthorized requests, potentially making the controller unstable. Update/mitigation: Yokogawa states the memory exhaustion vulnerability is addresse...

CVE-2018-17900

Yokogawa STARDOM Controllers (FCJ, FCN-100, FCN-RTU, FCN-500; all versions R4.10 and prior) are affected by CVE-2018-17900 due to the web application’s insufficient protection of credentials, enabling an attacker to obtain remote-access credentials. The issue stems from inadequate credential hand...

CVE-2018-17902

The CVE-2018-17902 entry applies to Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, and FCN-500 (R4.10 and prior). The issue is due to multiple session-management methods that could lead to a denial of service of remote management functions (Session Fixation/Wrong handling). The ICS advisory ...

Google+ Shuts Down Over Breach as Google Offers New Privacy Features

Google got caught hiding a privacy issue affecting 500,000 users on the same day it rolled out privacy protections...

CVE-2018-17891

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

Code injection

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

Semmle: Server side includes in https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/savePublicInformation leads to 500 server error and D-DOS

Summary: Improper sanitizing of input in one of the input forms in https://lgtm-com.pentesting.semmle.net/internalapi/v0.2/savePublicInformation leads to server side include that causes a 500 internal server error and a possible denial of service. Description: After login in to semmle , in other ...

Carbon Black Report: A Case Study on Threat Hunting

There are certain seminal experiences you’ll remember all your life — your first kiss, your college graduation, the smell of your favorite home-cooked meal — and then hundreds of mini-experiences that helped you reach each milestone that in short order disappeared from view. The memories you carr...

CVE-2018-16705

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext...

CVE-2018-16705

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the system's usernames and passwords. This includes the Admin and Service user accounts and their unsalted MD5 hashes, as well as the SMS server password in cleartext...

CVE-2018-16591

CVE-2018-16591 affects FURUNO FELCOM 250 and FELCOM 500 devices. The issue allows unauthenticated users to change passwords for Admin, Log, and Service accounts, as well as the protected SMS panel via /cgi-bin/sm_changepassword.cgi and /cgi-bin/sm_sms_changepasswd.cgi. Documented impact is creden...

Sentrifugo HRMS 3.2 - deptid SQL Injection

Sentrifugo HRMS 3.2 - deptid SQL Injection Exploit Title: Sentrifugo HRMS 3.2 - 'deptid' SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-08-26 Google Dork: N/A Vendor: http://www.sapplica.com Software Link: http://www.sentrifugo.com/download Affected Version...