CVE-2019-2637

CVE-2019-2637 affects Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology) in versions 8.55, 8.56 and 8.57. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, with successful attacks potentially enabling una...

CVE-2019-2618

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2017-11430

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

CVE-2017-11429 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11428

CVE-2017-11428 affects OneLogin Ruby-SAML up to version 1.6.0. The issue arises from improper use of XML DOM traversal and canonicalization results, allowing manipulation of SAML data without breaking the cryptographic signature and potentially bypassing authentication to SAML service providers. ...

PT-2019-7878 · Onelogin · Pythonsaml

Name of the Vulnerable Software and Affected Versions: OneLogin PythonSAML versions 2.3.0 and earlier Description: The issue may allow an attacker to manipulate SAML data without invalidating its cryptographic signature, potentially bypassing authentication to SAML service providers. This is due ...

Oracle Fusion Middleware WebLogic Server Access Control Error Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

MGASA-2019-0144 Updated koji packages fix security vulnerability

Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By passing carefully constructed arguments to these calls, an unauthenticated user can issue arbitrary SQL commands to Koji’s database. This gives the attacker broad ability to manipulate or destroy data CVE-2018-1002161...

Magento 2.1.x < 2.1.17 / 2.2.x < 2.2.8 / 2.3.x < 2.3.1 SQL Injection

The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitize the user-supplied 'from' and 'to' inputs to the 'prepareSqlCondition' function of the '\Magento\Framework\DB\Adapter\Pdo\Mysql' class. An unauthenticated, remo...

CVE-2019-6538

CVE-2019-6538 concerns Medtronic Conexus radio telemetry protocol lacking authentication/authorization. Connected sources (ICS advisory and coverage) specify the affected devices include MyCareLink Monitor (versions 24950/24952), CareLink Monitor (2490C), CareLink 2090 Programmer, and multiple Me...

Joomla Geommunity3es 1.4 SQL Injection

Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : nordmograph.com Software Download Link : nordmograph.com/extensions /index.php?option=comvirtuemart&view=productdetails...

Joomla FlexiContent 3.2.1.15 SQL Injection

Exploit Title : Joomla FlexiContent Components 3.2.1.15 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : flexicontent.org Software Download Link : github.com/FLEXIcontent/flexicontent-cck/archive/v3.2.1.15.zip Software...

Ncat TLS Listener

This host seems to be running an instance of Ncat that is listening over TLS. Ncat is an open source networking tool that can be used as a backdoor to allow unauthorized entry and control of the remote host An attacker may use it to steal your passwords, modify your data, and prevent you from...

Joomla EasyBookReloaded 3.3.2 SQL Injection

Exploit Title : Joomla EasyBookReloaded Components 3.3.2 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : joomla-extensions.kubik-rubik.de Software Download Link :...

Joomla DT Register 4.0.3 SQL Injection

Exploit Title : Joomla DT Register Components 4.0.3 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : dthdevelopment.com Software Download Link :...

phpMyVisites CNTNT Templates 2.4 SQL Injection

Exploit Title : phpMyVisites CNTNT Templates 2.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : phpmyvisites.net Software Download Link : phpmyvisites.net/telechargements.html Software Information Link :...

Joomla ExtCalendar 2.0 SQL Injection

Exploit Title : Joomla ExtCalendar 2.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : sourceforge.net/projects/extcal/ - github.com/simoami Software Download Link : sourceforge.net/projects/extcal/files/latest/download...

Joomla WordPress Blog 4.8.0 SQL Injection

Exploit Title : Joomla WordPress Blog 4.8.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : cms2cms.com - corephp.com Software Download Link : corephp.com/joomla-products/wordpress-for-joomla/buy-now/new Software...

What are Data Manipulation Attacks, and How to Mitigate Against Them

Conventional wisdom says that once an attacker is in the system, moving laterally from network to network, the damage is already done. The adversary has found a way in and more than likely identified the data they’re after. They simply need to exfiltrate it, the last step of the kill chain, to la...

Joomla ActivityManager 5.3 SQL Injection

Exploit Title : Joomla ActivityManager Components 5.3 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : codecanyon.net Software Information Link : codecanyon.net/item/activity-board-activity-manager/634766 Software Versio...