CVE-2015-4626

B.A.S C2Box before 4.0.0 r19171 relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft...

CVE-2015-4626

B.A.S C2Box before 4.0.0 r19171 relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft...

CVE-2015-4626

CVE-2015-4626 affects B.A.S C2Box; versions before 4.0.0 (r19171) rely on client-side validation, enabling a remote attacker to bypass validation and corrupt business logic via negative overdraft input. The vulnerability stems from unvalidated client input allowing server-side impact. >=4.0.0 ...

Cisco Webex Meeting - Open Redirect Web Vulnerability

Document Title: =============== Cisco Webex Meeting - Open Redirect Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1950 PSIRT ID: 1079904098 Bulletin:...

Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com

Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...

Blackboard LMS 9.1 SP14 Cross Site Scripting

Document Title: =============== BlackBoard LMS 9.1 SP14 - Title Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1901 Release Date: ============= 2017-01-10 Vulnerability Laboratory ID VL-ID: ====================================...

Fedora 25 : subversion (2017-c629f16f6c)

This update includes the latest stable release of Apache Subversion, version 1.9.5. Client-side bugfixes : - fix accessing non-existent paths during reintegrate merge - fix handling of newly secured subdirectories in working copy - info: remove trailing whitespace in --show-item=revision issue 46...

Update Rollup 3 for Windows Server 2012 Essentials

Update Rollup 3 for Windows Server 2012 Essentials Introduction This article lists the issues that are fixed in Update Rollup 3 for Windows Server 2012 Essentials. Important This update rollup contains server-side fixes. After you apply this update rollup, the client-side package is installed...

MS15-118: Description of the security update for the .NET Framework 3.5 on Windows 8 and Windows Server 2012: November 10, 2015

MS15-118: Description of the security update for the .NET Framework 3.5 on Windows 8 and Windows Server 2012: November 10, 2015 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework. The most severe of these vulnerabilities could...

MS15-118: Description of the security update for the .NET Framework 4.5.1 and 4.5.2 on Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: November 10, 2015

MS15-118: Description of the security update for the .NET Framework 4.5.1 and 4.5.2 on Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2: November 10, 2015 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework. The most seve...

MS15-118: Description of the security update for the .NET Framework 3.5.1 on Windows 7 SP1 and Windows Server 2008 R2 SP1: November 10, 2015

MS15-118: Description of the security update for the .NET Framework 3.5.1 on Windows 7 SP1 and Windows Server 2008 R2 SP1: November 10, 2015 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework. The most severe of these...

Naenara Browser 3.5 (RedStar 3.0 Desktop) - JACKRABBIT Client-Side Command Execution Exploit

Exploit for linux platform in category local exploits n0m3rcYn0M3rCyn0m3Rc N0MeRCYn0m3rCyn0m3rCyn0m n0MERCypDK var xunescape = unescape; oneblock = xunescape"%u0040%u1000"; stackpivot =...

Naenara Browser 3.5 (RedStar 3.0 Desktop) - JACKRABBIT Client-Side Command Execution

Naenara Browser 3.5 RedStar 3.0 Desktop - JACKRABBIT Client-Side Command Execution n0m3rcYn0M3rCyn0m3Rc N0MeRCYn0m3rCyn0m3rCyn0m n0MERCypDK var xunescape = unescape; oneblock = xunescape"%u0040%u1000"; stackpivot =...

Naenara Browser 3.5 (RedStar 3.0 Desktop) - 'JACKRABBIT' Client-Side Command Execution

n0m3rcYn0M3rCyn0m3Rc N0MeRCYn0m3rCyn0m3rCyn0m n0MERCypDK var xunescape = unescape; oneblock = xunescape"%u0040%u1000"; stackpivot = xunescape"%u6885%u0805%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u5a91%u0805%u4141%u4141"; nopsled =...

Microsoft (MEPN EDU) - Client Side Cross Site Vulnerability

Document Title: =============== Microsoft MEPN EDU - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1930 MSRC ID: 34153 TRK: 0497000318 Release Date: ============= 2016-12-14 Vulnerability Laboratory ID VL-ID:...

Gratipay: Content type incorrectly stated

Hello, Issue detail: The response contains the following Content-type statement: Content-Type: image/jpeg The response states that it contains a JPEG image. However, it actually appears to contain unrecognized content. Issue background: If a web response specifies an incorrect content type, then...

openSUSE Security Update : subversion (openSUSE-2016-1435)

This update for subversion fixes the following issues : - Version update to 1.9.5 : - Unrestricted XML entity expansion in moddontdothat and Subversion clients using https:// boo1011552, CVE-2016-8734 - Client-side bugfixes : - fix accessing non-existent paths during reintegrate merge r1766699 et...

NodCMS Installer Client-Side Cross Site Scripting

===================================================== Exploit Title : NodCMS Installer - Multiples Cross Site Web Vulnerability Date Discovered : 2016-11-10 Affected Products: NodCMS Installer - Content Management System Exploitation Technique: Remote Severity Level: Low Tested OS : Windows 10...

Rate-Me PHP Script 1.0 Cross Site Scripting

Exploit Title: Rate-Me PHP Script Persistent Cross Site Scripting Disclosure Date: 11/11/2016 Exploit Author: Boumediene KADDOUR a.k.a Sh311c0d3r Version: 1.0 Application website: https://www.phpjabbers.com/free-rate-me-script/ CVE : N/A Vulnerability Details: ===================== Rate-me php...

MDS API XSS Vulnerability

A cross-site scripting vulnerability exists in SQL Server MDS that could allow an attacker to inject a client-side script into the user's browser instance. The vulnerability is caused when the SQL Server MDS does not properly validate a request parameter on the SQL Server site. The script could...