The vulnerability of the Windows operating system, which allows a remote attacker to escalate their privileges

The Microsoft Windows operating system contains a vulnerability related to improper verification and application of impersonation levels. This allows attackers to bypass security checks and elevate their privileges, including gaining administrator account information. If exploited successfully,...

Unspecified Vulnerability in Oracle Fusion Middleware WebCenter Portal Component (CNVD-2015-02540)

Oracle Fusion Middleware is Oracle's suite of business innovation platforms for enterprise and cloud environments, of which Oracle WebCenter Portal is a component that seamlessly integrates portals with enterprise applications. A security vulnerability exists in the Portlet Services subcomponent ...

Wordpress Video Gallery SQL Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. A SQL injection vulnerability exists in Wordpress Video Gallery. An attacker can exploit this vulnerability to compromise the application, access or modify data...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...

IBM WebSphere DataPower XC10 appliance session hijacking vulnerability

The IBM WebSphere DataPower XC10 Appliance is a solution that combines the powerful DataPower hardware platform with IBM's distributed caching technology. A security vulnerability exists in the IBM WebSphere DataPower XC10 Appliance that allows remote attackers to hijack arbitrary user sessions t...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...

CVE-2015-2109

Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors...

Authentication flaw

Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors...

Easy Travel Portal SQL Injection Vulnerability

Easy Travel Portal is a set of ASP-based travel management applications. A SQL injection vulnerability exists in Easy Travel Portal, which arises from the program failing to adequately filter user-submitted input before constructing SQL query statements. An attacker could use this vulnerability t...

Mambo Login SQL Injection Vulnerability

Mambo is an open source web content management system CMS based on PHP and MySql. The system supports search engine optimization, template/theme downloads and traffic statistics. A SQL injection vulnerability exists in Mambo, which stems from the program failing to adequately filter user-submitte...

Pre News Manager 'news_detail.php' SQL Injection Vulnerability

Pre News Manager is an online news distribution system for the Australian PreProjects program. A SQL injection vulnerability exists in Pre News Manager, which arises from the program failing to adequately filter user-submitted input. An attacker could use this vulnerability to compromise the...

Multiple SQL Injection Vulnerabilities in Drupal Spider Contacts Module

Drupal is an open source content management platform. Multiple SQL injection vulnerabilities exist in the Drupal Spider Contacts module, which could be exploited by attackers to compromise an application, access and modify data, or potentially exploit a vulnerability in the underlying database...

Redaxscript < 2.3.0 SQLi Vulnerability

Redaxscript is prone to an SQL injection SQLi vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

WordPress Plugin Photo Gallery 'asc_or_desc' Parameter SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Photo Gallery 'ascordesc' Parameter due to the program failing t...

Multiple Input Validation Vulnerabilities in Gecko CMS

Gecko CMS is a content management system CMS based on PHP and MySQL. Gecko CMS suffers from SQL injection, cross-site scripting, and HTML injection vulnerabilities because it fails to adequately filter user-supplied input. Exploitation of these vulnerabilities allows attackers to perform...

Sefrengo CMS 'main.php' Cross-Site Scripting Vulnerability

Sefrengo CMS is an open source content management system. A cross-site scripting vulnerability exists in Sefrengo CMS 'main.php' due to the application failing to properly filter user-supplied input. This allows an attacker to steal cookie-based credentials, compromise the application, and access...

Kesion ICMS智能建站系统多处权限绕过，可修改任意用户密码

简要描述： Kesion ICMS2.5智能建站系统存在多处权限绕过 详细说明： Kesion ICMS智能建站系统多处权限绕过，修改任意用户资料，并可修改任意用户密码。 漏洞证明： 系统官网：http://www.kesion.com/ 系统演示站点：http://i.kesion.com/ 为了演示漏洞，注册了用户名为test1和test2的两个用户。 漏洞一、修改任意用户基本资料： 1、登录test1用户--》会员中心--》修改我的资料。 2、使用代理拦截请求，修改cookie中的username字段为被攻击的用户名： 3、登录被攻击用户，用户资料被修改 漏洞二、修改任意用户绑定手...

CVE-2014-7194

TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access...

CVE-2014-7194

TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access...

CVE-2014-7194

CVE-2014-7194 affects TIBCO MFT Internet Server prior to 7.2.4, MFT Command Center prior to 7.2.4, Slingshot prior to 1.9.3, and Vault prior to 1.1.1. The issue allows remote attackers to obtain sensitive information or modify data by exploiting agent access. No exploitation details, affected ver...