PT-2017-6603

Name of the Vulnerable Software and Affected Versions WP EasyCart plugin versions 1.1.30 through 3.0.20 Description The issue allows remote attackers to gain administrator privileges and execute arbitrary code. This is achieved via the option name and option value parameters in the ec ajax update...

Facebook Launches Free Mobile Internet Service In India

Last year, the founder of the Social Network giant highlighted the future of universal Internet access, the dream that Facebook founder Mark Zuckerberg wants to fulfill — Making Internet access available to everyone across the world just like a service as essential as of 911 in the case of an...

Extract data from pcap files: PCredz

Extract data from pcap files with PCredz This tool extracts Credit card numbers, NTLMDCE-RPC, HTTP, SQL, LDAP, etc, Kerberos AS-REQ Pre-Auth etype 23, HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface. PCredz Features: Extract from a pcap file or from a live...

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection Exploit Title: vBulletin vBSSO Single Sign-On – = 1.4.15 This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file in the fetchUserinfo function. It requires a big UNION ALL SELECT query and commenting out the LIMIT function of...

Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

Oracle MySQL for Microsoft Windows FILE Privilege Abuse

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

PT-2014-8817

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.18 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the sort or dir parameter to "view all set.php". Recommendations For versions prior to 1.2.18, update to...

PT-2014-8561

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition versions prior to 7.1 build 7105 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved v...

PT-2014-8562

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro versions prior to 7.1 build 7105 ManageEngine Password Manager Pro Managed Service Providers edition versions prior to 7.1 build 7105 Description The issue allows remote authenticated users to execute arbitrar...

Eleanor CMS Open Redirect

URL Open Redirect on Eleanor CMS Risk: Low CWE number: CWE-601 Vendor: eleanor-cms.ru Version: All Date: 11/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Linux Ubuntu 14.04 ; Mozilla Firefox 33.0 Vulnerable File: go.php Exploit: +...

Fedora 20 : claws-mail-3.11.1-2.fc20 / claws-mail-plugins-3.11.1-1.fc20 / libetpan-1.6-1.fc20 (2014-14234) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

PT-2014-8663

Name of the Vulnerable Software and Affected Versions Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway version 1.0 with firmware CH6640-3.5.11.7-NOSH Description The issue allows remote attackers to cause a denial of service, which results in disconnecting all WiFi clients. This...

all-nettools.com XSS vulnerability

Open Bug Bounty ID: OBB-52243 Description| Value ---|--- Affected Website:| all-nettools.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

all-nettools.com XSS vulnerability

Open Bug Bounty ID: OBB-52242 Description| Value ---|--- Affected Website:| all-nettools.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2014-7488

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7488

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7488

The CVE-2014-7488 entry concerns the Android app Vineyard All In (com.wVineyardAllIn) 0.1, which fails to validate SSL X.509 certificates, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. The connected NVD/NIST entry confirms the sam...

CVE-2014-7488: Undefined Security Weakness

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...