SynaMan 40 Build 1488 SMTP Credential Disclosure

Exploit Author: bzyo CVE: CVE-2018-10814 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0 build 1488 Software Link:...

PHPOKCMS has a logical design flaw

PHPOKCMS is an enterprise station CMS system developed in PHP+MYSQL language. A logical design vulnerability exists in PHPOKCMS. Attackers can log in to other accounts by grabbing packets and blasting CAPTCHA...

Flintcms Privilege Vulnerability

flintcms is a content management system CMS. A power-lifting vulnerability exists in flintcms 1.1.9 and earlier versions. An attacker can exploit this vulnerability to compromise an account...

Backend Login Bypass Vulnerability in Tale Blog System

Tale blog system is a java development blog system. A backend login bypass vulnerability exists in Tale Blog System. An attacker can exploit this vulnerability to construct a cookie to log into any account...

CVE-2017-1411: Insufficiently Protected Credentials

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399...

PT-2018-5622

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Governance Virtual Appliance versions 5.2 through 5.2.3.2 Description: The issue makes it easier for attackers to compromise user accounts due to a lack of strong password requirements by default. Recommendations: For...

Critical Authentication Flaws in Cisco Policy Suite Patched

Cisco has patched four critical security vulnerabilities surrounding a lack of authentication requirements in its Policy Suite for mobile carriers. These would allow remote attackers to potentially exfiltrate information, compromise wireless subscriber account information, meddle with databases o...

HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability

Document Title: =============== HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1557 Video: https://www.vulnerability-lab.com/getcontent.php?id=1929 Release Date: ============= 2018-07-19 Vulnerabili...

CVE-2017-1601

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

CVE-2017-1601

CVE-2017-1601 affects IBM Security Guardium Database Activity Monitor: vulnerable in versions 10.0, 10.0.1, and 10.1–10.1.4 where strong-password requirements are not enforced by default, enabling potential account compromise. The IBM bulletin enumerates the affected releases and provides remedia...

PT-2018-6039

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 10.0 through 10.1.4 Description: The issue allows attackers to compromise user accounts more easily due to a lack of strong password requirements by default. Recommendations: For versions 10.0 through 10.1.4,...

CVE-2017-1601: Weak Password Requirements

IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624...

21 grams of mobile pro-link assistant app has a logical design flaw

21g cell phone pro-connection assistant APP is a software that comes with 21g cell phone for helping children to operate their mom and dad's cell phone remotely, so that children can connect with their mom and dad's cell phone at any time in the easiest way. A logical design vulnerability exists ...

Open-AuditIT Professional 2.1 Cross Site Request Forgery

Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery CSRF Date: 27-03-2018 Exploit Author: Nilesh Sapariya Contact: https://twitter.com/nileshloganx Website: https://nileshsapariya.blogspot.com Vendor Homepage: https://www.open-audit.org/ Software Link :...

WolfCMS Cross-Site Scripting Vulnerability (CNVD-2018-07056)

Wolf CMS is a lightweight content management system written in PHP. A stored cross-site scripting vulnerability exists in WolfCMS 0.8.3.1 in the Layout Name under the Layout tab. A low-privileged user can exploit this vulnerability to steal cookies from administrative users and compromise the...

CVE-2018-1000084

WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name from Layout tab that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the...

CVE-2018-1000084

WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name from Layout tab that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the...

CVE-2018-1000084: Improper Neutralization of Input During Web Page Generation

WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name from Layout tab that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the...

PT-2018-9263

Name of the Vulnerable Software and Affected Versions: WolfCMS version 0.8.3.1 Description: The issue concerns a Stored Cross-Site Scripting vulnerability in the Layout Name, accessible from the Layout tab. This can be exploited by entering Javascript code into the Layout Name, potentially allowi...

Imgur: CSRF leads to a stored self xss

Followup from 311460 Summary Self xss and CSRF are both out of scope, but when paired it is possible to create an attack on a user. Description A favorites folder with an xss payload for a name will launch when saving an image to said folder. This can be verified by following these steps Visit yo...