Create-Project Manager 1.07 Cross Site Scripting / HTML Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?srank=3 Version: 1.6 Tested on:...

The vulnerability of the org.apache.xmlrpc.parser.XmlRpcResponseParser.addResult method in the Apache XML-RPC library, related to the restoration of unreliable data in memory, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the org.apache.xmlrpc.parser.XmlRpcResponseParser.addResult method in the Apache XML-RPC library is related to an deserialization exception from the server side, serialized in the faultCause attribute of XMLRPC error messages. Exploiting this vulnerability can allow a malicio...

Create-Project Manager 1.07 Cross Site Scripting / HTML Injection

Exploit Title: Create-Project Manager 1.07 Multi XSS /HTML injection Vunlerabilities Google Dork:N/A Date: 2020-05-06 Exploit Author: @ThelastVvV Vendor Homepage: https://codecanyon.net/item/create-project-manager-with-authenticator/20483329?srank=3 Version: 1.6 Tested on: 5.4.0-kali4-amd64...

corecompetence.cc Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1156974 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

SAE IT-systems FW-50 Remote Telemetry Unit (RTU)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SAE IT-systems Equipment: FW-50 Remote Telemetry Unit RTU Vulnerabilities: Cross-site Scripting, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

Waychar enrollment system aj***.php page pa***_ne*** parameter has SQL injection vulnerability

Waychar Enrollment System is a PHP/MYSQL based enrollment system. A SQL injection vulnerability exists in the aj.php page pane parameter of Waychar enrollment system, which can be exploited by an attacker to obtain sensitive information from the database...

CVE-2019-4286

IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160514...

Vulnerability of the function in the Linux kernel’s drivers/net/wireless/rsi/rsi_91x_usb.c, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information

The vulnerability of the function in the drivers/net/wireless/rsi/rsi91xusb.c kernel of the Linux operating system is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information by...

The vulnerability of the Squid proxy server, related to the lack of protection for service data, allows attackers to disclose the protected information.

The vulnerability of the Squid proxy server is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to disclose the protected information...

php: Heap buffer over-read in exif_process_user_comment()

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

CVE-2020-6821

When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird...

Spoofing

When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird...

CVE-2020-6821

When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird...

CVE-2020-6821

When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird...

The vulnerability of the library for grammatical analysis of EXIF files in libexif allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the library for grammatical analysis of EXIF files in libexif is due to a numerical overflow condition. Exploiting this vulnerability can allow an attacker, operating remotely, to access confidential data, compromise its integrity, and even cause service failures...

CVE-2020-10903

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

OpenJDK: Incomplete enforcement of algorithm restrictions for TLS (JSSE, 8232424)

Vulnerability in the Java SE product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability...

Zoom Communications Registered Users Enumeration

Summary Zoom doesn’t properly validate certain XMPP requests coming from the clients, which can lead to disclosure of details about registered users. Tested Versions Zoom Service As Of April 9th 2020 Product URLs https://zoom.us CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

The Mozilla Foundation Security Advisory describes this flaw as: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially...