CVE-2017-14124

The CVE-2017-14124 entry concerns eLux RP 5.x systems: specifically versions before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR. The vulnerability arises when using the classic desktop mode, where an attacker could start applications that are not defined, even if the user lacks permissions to modify ...

ICStudents 1.2 - 'key' SQL Injection

Exploit Title: Students Course Assessment Test Script 1.2 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/student-course-assessment-test-script.htm Demo: http://icloudcenter.net/demos/icstudents/ Version: 1.2...

ICCallLimousine 1.1 - 'key' SQL Injection

Exploit Title: Car Rental Script 1.1 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/limousine-car-hire-script.html Demo: http://icloudcenter.net/demos/iccalllimousine/ Version: 1.1 Category: Webapps Tested on:...

Escort Marketplace 1.0 - SQL Injection

Exploit Title: Escort Website Script 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/escort-website Demo: http://escortwebsite.scriptzee.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...

Wallarm to sponsor OWASP AppSec USA

If you are a SecOps or DevOps professional you can not miss the application security event of the year: AppSec USA, September 19–22nd at Disney Coronado Spring Resort, Orlando, FL Use the code: UNLM50WLLRM to register to get $50 discount. You will get great information on the new security tools a...

Hot air classes on the site of the SQLi and XSS vulnerabilities bug-vulnerability warning-the black bar safety net

Last month in order to practice hand, I choices one of the more popular sites goodwesite.com as I penetrate the leaking test tool. In flaws in the excavation process, I've invented the Web PresenceSQL injectionandXSSflaws. The official start of the article content, let's first briefly understand...

Syntribos: An Open Source API Security Testing Tool

PenTestIT RSS Feed Web application security testing is a multi-faceted and yet important domains today. A few years ago, it was only the front end security tests and then came the backend. As newer endpoints are being exposed, it becomes imperative to test their security too. Syntribos is one suc...

Managing Security in a DevOps Environment

DevOps is a software development practice in which development and operations engineers collaborate during the entire product lifecycle. With the adoption of DevOps at mainstream levels, we now see security starting to take a bigger role in DevOps’ day-to-day responsibilities. From a security...

CVE-2016-2964

CVE-2016-2964 affects IBM Sametime versions 8.5.2 and 9.0. The vulnerability arises when an error message shown to a user is overly detailed and may reveal internal details about the application, leading to potential information disclosure. According to the linked sources, this impacts confidenti...

Web-based OSINT and Active Reconnaissance Suite: D0xk1t

Active reconnaissance, information gathering and OSINT built in a portable web application. D0xk1t is an open-source , self-hosted and easy to use OSINT and active reconnaissance web application for penetration testers. Based off of the prior command-line script, D0xk1t is now fully capable of...

Affiliate Niche Script 3.4.0 - SQL Injection

Exploit Title: Affiliate Niche Script 3.4.0 SQL Injection Dork: N/A Date: 21.08.2017 Vendor Homepage: https://scriptoffice.com/ Software Link: https://soft.scriptoffice.com/projects/affiliatenichescript/wiki/MainMenu Demo: http://demodesigns.affiliatenichescript.com/ Version: 3.4.0 Category:...

FAQ: Citrix ADC on Microsoft Azure

Q: What is Citrix ADC, formerly Netscaler ADC, on Microsoft Azure? A: Citrix ACD on Microsoft Azure is a L4-L7 virtual networking appliance that ensures organizations have access to secure and optimized applications and assets deployed in the cloud. Citrix ADC on Azure provides a foundation for t...

Photogallery Project 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version:...

Photogallery Project 1.0 - SQL Injection

Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

CVE-2017-7672

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12...

WordPress Plugin Easy Modal 2.0.17 - SQL Injection

WordPress Plugin Easy Modal 2.0.17 - SQL Injection DefenseCode ThunderScan SAST Advisory WordPress Easy Modal Plugin Multiple Security Vulnerabilities Advisory ID: DC-2017-01-007 Advisory Title: WordPress Easy Modal Plugin Multiple Vulnerabilities Advisory URL:...

WordPress PressForward 4.3.0 Cross Site Scripting

DefenseCode ThunderScan SAST Advisory WordPress PressForward Plugin Security Vulnerability Advisory ID: DC-2017-05-007 Advisory Title: WordPress PressForward Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress PressForward plugin Language: PHP...

WordPress Podlove Podcast Publisher 2.5.3 SQL Injection

DefenseCode ThunderScan SAST Advisory WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory ID: DC-2017-05-006 Advisory Title: WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Podlove...

Поиск работы на HeadHunter. Вакансии рядом с домом - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Поиск работы на HeadHunter. Вакансии рядом с домом published at the 'play' market has multiple vulnerabilities...

Advantech SUSIAccess <= 3.0 - RecoveryMgmt File Upload Exploit

Exploit for jsp platform in category web applications ! /usr/bin/env ruby =begin Exploit Title: Advantech SUSIAccess RecoveryMgmt File Upload Date: 07/31/17 Exploit Author: james fitts Vendor Homepage: http://www.advantech.com/ Version: Advantech SUSIAccess = 3.0 Tested on: Windows 7 SP1 Relavant...