SAP Customer Relationship Management (CRM) WebClient UI Cross-Site Scripting Vulnerability

SAP Customer Relationship Management is a customer relationship management solution. A cross-site scripting vulnerability exists in the SAP Customer Relationship Management CRM WebClient UI. A remote attacker could exploit the vulnerability to execute arbitrary script code in an unsuspecting user...

DeWorkshop 1.0 Arbitrary File Upload

Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload Dork: N/A Date: 18.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737 Demo: https://demo.sarutech.com/deworkshop/ Version: 1.0 Category: Webapps Tested on:...

Corner-Case Bug Potentially Affecting 10 Cb Response Customers

On Thursday, August 10, Carbon Black discovered a corner-case bug potentially affecting 10 Cb Response customers. The bug was introduced in April 2017 and requires a set of specific conditions to occur in order to be triggered. We have remediated the bug, proactively notified the 10 potentially...

Akamai Is Named A Leader In Gartner's Magic Quadrant For Web Application Firewalls

"Don't work for recognition, but do work worthy of recognition" - H. Jackson Brown. A friend sent this quote to me after I explained to her my ambivalence about being recognized by Gartner as a "Leader" in their Web Application Firewall Magic Quadrant. I had mixed feelings because I wanted to...

Faulty Firmware Auto-Update Breaks Hundreds of 'Smart Locks'

More features, more problems! Today, we are living in a digital age that is creating a digital headache for people by connecting every other unnecessary home appliance to the Internet. Last week, nearly hundreds of Internet-connected locks became inoperable after a faulty software update hit some...

Call for Papers: Qualys Security Conference 2017

Our annual user conference, QSC17, is quickly approaching and we are looking for customer presentations that showcase hot topics related to security and best practices via case studies leveraging the use of Qualys technologies. If you would like to be considered as a presenter, please send a...

SugarCRM Incomplete Blacklist Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. An incomplete...

Boozt Fashion AB: [www.boozt.com] - Authentication bypass

Description I have found a flaw in the authentication process when accessing the website by visiting an unsubscribe link. PoC 1. Visit http://click.email.boozt.com/?qs=723df61c937e4dbf9e378d2157f7907baa95fa00699f2b4d13e192b1d14ed67323d5c7a75c6f801baf1e68c2beabbc43d574caeb9b6f8c085971631d636b3cda ...

Oracle CRM Technical Foundation Remote Vulnerability (CNVD-2017-26284)

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. Oracle CRM Technical Foundation ...

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

Authorization

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

Cisco DPC3939 Firmware Unauthorized Access Vulnerability

Cisco DPC3939 is a wireless voice gateway product from Cisco USA. A security vulnerability exists in the Cisco DPC3939 firmware. An attacker accesses the CM MAC of a Comcast customer gateway by sniffing the gateway's Wi-Fi traffic...

VehicleWorkshop Authentication Bypass / SQL Injection

Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC ================ Admin Login Page :...

VehicleWorkshop Arbitrary File Upload

Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload Exploit Author: Touhid M.Shaikh Date: 1/08/2017 Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Tested on : Kali Linux 2.0 64 bit and Windows 7 =================== Vulnerable Page: ===================...

VehicleWorkshop - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC...

VehicleWorkshop - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload Exploit Author: Touhid M.Shaikh Date: 1/08/2017 Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Tested on : Kali Linux 2.0 64 bit and Windows 7...

VehicleWorkshop - Arbitrary File Upload

Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload Exploit Author: Touhid M.Shaikh Date: 1/08/2017 Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Tested on : Kali Linux 2.0 64 bit and Windows 7 =================== Vulnerable Page: ===================...

VehicleWorkshop - Authentication Bypass

Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC ================ Admin Login Page :...

Threat Outbreak Alert RuleID30034: Email Messages Distributing Malicious Software on July 31, 2017

Medium Alert ID: 54635 First Published: 2017 July 31 15:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30034 may contain the following files: Name | Siz...