CVE-2017-14703

CVE-2017-14703 describes a SQL injection vulnerability in the Cash Back Comparison Script 1.0. The vulnerability allows an unauthenticated attacker to exploit the application by crafting requests via the PATH_INFO to the search/ endpoint, enabling arbitrary SQL execution. Public references includ...

Cash Back Comparison Script SQL Injection Vulnerability

Cash Back Comparison Script is a cash back script. A SQL injection vulnerability exists in Cash Back Comparison Script version 1.0. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

CVE-2017-14703: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO to search/...

PT-2017-13636

Name of the Vulnerable Software and Affected Versions Cash Back Comparison Script version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the PATH INFO to the "search/" endpoint. Recommendations For version 1.0, consider restricting access...

OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability

Description OWASP AntiSamy is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the...

NEC EXPRESS CLUSTER clpwebmc Remote Root Exploit

NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster configuration and management. The underlying webserver 'clpwebmc' runs as root and accepts connections on TCP port 29003 which can be initiated without authentication in the default installation. / 2017 update: as of 3.3.4...

Beers with Talos EP11 - This is How the World Ends, Not with a Whimper but with Cyber Mercenaries

Beers with Talos BWT Podcast Episode 11 is now available. Download this episode and subscribe to Beers with Talos:If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcastBeers wi...

evince security update

CentOS Errata and Security Advisory CESA-2017:2388 An update for evince is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Linux Meterpreter, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- Linux reverse TCP stager. module MetasploitModule CachedSize = 228 include...

Philips' DoseWise Portal Hardcoding Vulnerability

Philips' DoseWise Portal is a web-based reporting and tracking tool for radiation exposure. A hard-coded vulnerability exists in Philips' DoseWise Portal. An attacker exploiting this vulnerability would first require elevated privileges in order for the attacker to access web application back-end...

R Command Shell, Reverse TCP

Connect back and create a command shell via R This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 150 include Msf::Payload::Single include Msf::Payload::R include...

CNNVD on the United States Netsarang company multi software the presence of malicious code briefings-vulnerability warning-the black bar safety net

Recently, the national information security vulnerabilities library CNNVD received about the the United States Netsarang company more software there malicious code in case the message send. The company Xshell And Xmanager remote connection use of the product nssock2.dll module in the presence of...

CVE-2017-1174: Improper Neutralization of Special Elements used in an SQL Command

IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123296...

PT-2017-12215

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator Standard Edition version 5.2 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

Code injection

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...

CVE-2017-11725

CVE-2017-11725 affects IBM Security Secret Server (Thycotic Secret Server) prior to 10.2.000019. The vulnerability resides in the share function where the Back Button is mishandled, causing unintended redirections (open redirect-like behavior) and potential user confusion or credential exposure r...

CVE-2017-11725: URL Redirection to Untrusted Site

The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections...