SQL Injection Vulnerability in UFIDA Software NC-IUFO System

UFIDA NC-IUFO system is a financial management software. The UFIDA NC-IUFO system suffers from a SQL injection vulnerability that can be exploited by an attacker to gain access to website database information...

Office Anywhere 网络智能办公系统某版本前台获取数据库（无需登录）

简要描述： Office Anywhere 网络智能办公系统某版本前台获取数据库（无需登录） 详细说明： Office Anywhere 2011 网络智能办公系统 存在一个通用路径泄漏问题，而泄漏的登录地址可以不需要权限登录到phpmyadmin 且权限为root /mysql/main.php 解密出来可直接登录,这里就不登录进去了 漏洞证明： 附部分案例： http://218.24.163.216:8080/ http://220.171.81.126:1234/ http://221.2.43.9:8000/ http://221.204.213.24/...

SQL injection vulnerability in the 'merid' parameter of the mining system of Shenzhen Jishu Communication Co.

Ltd. is a communication enterprise providing communication services and communication products. A SQL injection vulnerability exists in the program mining system of Shenzhen Jishu Communication Co. The lack of filtering of the 'merid' parameter allows an attacker to exploit the vulnerability to...

samba: SAMR and LSA man in the middle attacks

A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol MS-SAMR and the Local Security Authority Domain Policy Remote Protocol MS-LSAD. Any authenticated DCE/RPC connection that a client initiates against a server could be used by a...

SQL Injection Vulnerability in Submission System of Nanjing Jenohan Software Technology Co.

Nanjing Jenohan Software Technology Co., Ltd. is for the development of hospital full cost accounting decision support software system, hospital performance management information system and hospital customer management information system. A SQL injection vulnerability exists in the contribution...

Panmicro e-cology v8 SQL Injection Vulnerability

Panmicro collaborative management application platform e-cology is a set of collaborative business platform. A SQL injection vulnerability exists in the id parameter of the Panmicro e-cology oa system/hrm/resource/HrmResourceContactEdit.jsp page, which allows an attacker to elevate the privileges...

krb5: xdr_nullstring() doesn't check for terminating null character

An out-of-bounds read flaw was found in the kadmind service of MIT Kerberos. An authenticated attacker could send a maliciously crafted message to force kadmind to read beyond the end of allocated memory, and write the memory contents to the KDC database if the attacker has write permission,...

Symantec Endpoint Protection Manager and Client SQL Injection Vulnerability

Symantec Endpoint Protection is a suite of antivirus software from Symantec Corporation in the U.S. SEP Manager and Client are the management and client software. A SQL injection vulnerability exists in Symantec Endpoint Protection Manager and Client, which allows remote attackers to exploit the...

Cisco Prime LAN Management Solution Hardcoding Vulnerability

Cisco Prime LAN Management Solution is a LAN-based network management solution from Cisco. A hard-coded vulnerability exists in Cisco Prime LAN Management Solution, which allows a local attacker to decrypt data in the LMS database using a hard-coded key to compromise an affected device...

PayPal remote code execution vulnerability-vulnerability warning-the black bar safety net

! /Article/UploadPic/2016-1/2016126182812936.jpg In 2 0 1 5 years 1 2 months,I in the PayPal Business Sitemanager.paypal.comfound a serious vulnerability,this vulnerability exist,so that I can through unsafe JAVA deserialize the object,in the PayPal website, the server on the remote using the she...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2016-00155)

IBM Sterling B2B Integrator supports highly secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterling B2B Integrator 5.2. Allows a local user to obtain sensitive plaintext web service information by exploiting...

Design/Logic Flaw

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access...

CVE-2015-7438

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access...

SQL Injection Vulnerability in Broadband Authentication and Billing System of Chengdu Starry Blue Ocean Network Technology Co.

Blue Ocean Premier Broadband Access Gateway is a specialized intelligent device for Ethernet broadband access. SQL injection vulnerability exists in the broadband authentication billing system of Chengdu Starry Blue Ocean Network Technology Co., Ltd. There is an injection point in the back-end...

WordPress Welcart plugin SQL injection vulnerability (CNVD-2015-08468)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Welcart is one of the plug-ins used to create shopping sites. A SQL injection vulnerability exists in WordPress Welcart...

Multiple Vulnerabilities in the Program Management System of Zhengzhou Wecom Technology Co.

WKM Technology is is a broadband network multimedia application system solutions and equipment providers, system integrators and information service providers, is the Beidou timing application system solutions and equipment providers, the main business of education informatization, party members ...

SQL Injection in Osclass

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database an...

Cisco Videoscape Distribution Suite Service Manager Security Bypass Vulnerability

Cisco Videoscape Distribution Suite Service Manager is a suite of reporting and analysis tools for VDS products from Cisco in the United States. Cisco Videoscape Distribution Suite Service Manager fails to use RBAC control over back-end database access in real-time, allowing remote attackers to...

Ipswitch WhatsUp Gold SQL Injection Vulnerability

Ipswitch WhatsUp Gold is a unified suite of infrastructure and application monitoring software. IPswitch WhatsUp Gold suffers from a SQL injection vulnerability. Failure to properly filter the 'UniqueID' parameter allows remote attackers to exploit the vulnerability to submit specially crafted SQ...

LOCKON EC-CUBE BbAdminViewsControl Plugin SQL Injection Vulnerability

LOCKON EC-CUBE is a set of open source e-commerce website building platform. bbAdminViewsControl is one of the backend screen management plugin. LOCKON EC-CUBE BbAdminViewsControl suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability by submitting...