Harvest: Editing a project (LIMITED)

Hey there, I found out that invited user to a project cannot edit the project settings unless he is a PROJECT MANAGER on it. Now there is an option while editing project to make it BILLABLE OR NOT... When it is NOT billable it is quite impossible to BILL an invoice for it without making it...

Weak Password Vulnerability in EVERGREEN's Broadband Billing System

EVERGETTING BROADBAND BILLING SYSTEM is to support a variety of user authentication methods. A weak password vulnerability exists in EVERJETSON Broadband Billing System. The presence of default passwords hsj/hsj, jixunadmin/ jixunadmin allows attackers to exploit the vulnerability to obtain...

SQL Injection Vulnerability in Loginname Parameter of EVERGETS Broadband Billing System

EVERGETTING BROADBAND BILLING SYSTEM is to support a variety of user authentication methods. A SQL injection vulnerability exists in the loginname parameter of the EVERJETSON Broadband Billing System. This vulnerability can be exploited by attackers to obtain sensitive information...

Uber: Users can falsely declare their own Uber account info on the monthly billing application

When applying for monthly billing, statistics and data regarding account usage that was fetched and subsequently submitted could be tampered with. This data would be reviewed by a human making a credit decision, potentially influencing their decision inappropriately in favor of the applicant. Whe...

DMA Radius Manager 4.1.5 Cross Site Request Forgery

tanks: Dr Ms Jk - n1arash - Milad Hacking - malahsky...

CVE-2016-0635

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Maste...

QIWI: Xss on billing

При нажатии "Вернуться на сайт" вызывается javascript:alert F104691 - href vulnerable https://bill.qiwi.com/order/external/success.action?comm=test&from=6045&to=&successUrl=javascript%3Aalert1//&order=747156761&phone=79051564213 Уязвимое поля: successUrl, failUrl Как пофиксить: Сделать фильтр и...

Clinic Management System - Blind SQL Injection

Vulnerability Title : Clinic Management System Unauthenticated Blind SQL Injection apointment.php age Vulnerability Date : 11/07/2016 Exploit Author : Yakir Wizman Vendor Homepage : http://rexbd.net/software/clinic-management-system Version : All Versions Tested on : Apache | PHP 5.5.36 | MySQL...

SQL Injection Vulnerability in Xunjie Network Broadband Billing Management System

Shenzhen Youjialian Technology Co., Ltd. is a provider of client-side network and communication technology and equipment. Xunjie Network Broadband Billing Management System is the billing system of Shenzhen Youjialian Technology Co. A SQL injection vulnerability exists in the Xunjie Network...

24online SMS_2500i 8.3.6 build 9.0 - SQL Injection

Exploit Title: SQL Injection In 24 Online Billing API Date: 03/07/2016 Exploit Author: Rahul Raz Vendor Homepage: http://24onlinebilling.com Software Name:24online Model SMS2500i Version: 8.3.6 build 9.0 Tested on: Ubuntu Linux Potentially others versions older than this are vulnerable too...

24online SMS_2500i 8.3.6 build 9.0 - SQL Injection

24online SMS2500i 8.3.6 build 9.0 - SQL Injection Exploit Title: SQL Injection In 24 Online Billing API Date: 03/07/2016 Exploit Author: Rahul Raz Vendor Homepage: http://24onlinebilling.com Software Name:24online Model SMS2500i Version: 8.3.6 build 9.0 Tested on: Ubuntu Linux Potentially others...

Srun3000 billing system /config/temp_srun. conf information disclosure

No description provided by source...

drchrono: User with no permissions can access full wdcalendar feed

Hi All, I've found a vulnerability related to access the calendar when a user has no permissions. Vulnerability I've create a doctor's account with a user who has no permission. Browsing the site, I noticed a call to...

Srun3000计费系统/index.php 参数file文件下载漏洞

No description provided by source...

TP Billing Plugin - Exported components vulnerabilities

HackApp vulnerability scanner discovered that application TP Billing Plugin published at the 'play' market has multiple vulnerabilities...

Invoice generator, Billing App - Dangerous filesystem permissions, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Invoice generator, Billing App published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID21896: Email Messages Distributing Malicious Software on March 23, 2016

Medium Alert ID: 44275 First Published: 2016 March 23 17:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID21896 may contain the following files: Name | Si...

Ubiquiti Networks airCRM Cross Site Scripting

Document Title: =============== Ubiquiti Networks Bug Bounty 9 - Invoice Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1728 Release Date: ============= 2016-02-22 Vulnerability Laboratory ID VL-ID:...

Ubiquiti Networks BB #9 - Invoice Persistent Vulnerabilities

Document Title: =============== Ubiquiti Networks BB 9 - Invoice Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1728 http://www.vulnerability-lab.com/getcontent.php?id=1739 Video View: https://www.youtube.com/watch?v=5uiXWxJzN...

This world really have a free steal traffic method?- Vulnerability warning-the black bar safety net

Yesterday, the white hat hacker“little very white guest”of heavy holes in the black bar safety net vulnerability on the platform is published. A hacker can through a simple method, unlimited use of the operator's traffic, the more frenzied is, whether it is mobile, Unicom or Telecom, the methods...