Ransomware Attacks on MySQL and MongoDB

Ransomware is arguably one of the most vicious types of attack cyber security experts are dealing with today. The impact ransomware attacks can have on an organization is huge and costly. A ransomware payment alone does not reflect the total expense of an attack—the more significant costs come fr...

CVE-2017-1311

IBM Insights Foundation for Energy 2.0 is affected by a SQL injection vulnerability. A remote attacker can send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. This is documented across multiple sources (e.g., NVD/NVD-derived entries and CNVD), whic...

Real Estate MLM Plan Script 1.0 SQL Injection

Exploit Title: Real Estate MLM plan script v1.0 - 'srch' Parameter SQL Injection Date: 2017-09-28 Exploit Author: 8bitsec Vendor Homepage: http://www.mlmscript.in/ Software Link: http://www.mlmscript.in/real-estate-mlm-script.html Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email:...

Real Estate MLM plan script 1.0 - srch SQL Injection

Real Estate MLM plan script 1.0 - srch SQL Injection Exploit Title: Real Estate MLM plan script v1.0 - 'srch' Parameter SQL Injection Date: 2017-09-28 Exploit Author: 8bitsec Vendor Homepage: http://www.mlmscript.in/ Software Link: http://www.mlmscript.in/real-estate-mlm-script.html Version: 1.0...

Real Estate MLM plan script 1.0 - 'srch' SQL Injection

Exploit Title: Real Estate MLM plan script v1.0 - 'srch' Parameter SQL Injection Date: 2017-09-28 Exploit Author: 8bitsec Vendor Homepage: http://www.mlmscript.in/ Software Link: http://www.mlmscript.in/real-estate-mlm-script.html Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email:...

CVE-2017-12227

CVE-2017-12227 corresponds to a blind SQL injection in the Cisco Emergency Responder SQL database interface. The vulnerability arises from failure to validate user-supplied input used in SQL queries, allowing an authenticated, remote attacker to craft URLs containing SQL statements and potentiall...

Hot air classes on the site of the SQLi and XSS vulnerabilities bug-vulnerability warning-the black bar safety net

Last month in order to practice hand, I choices one of the more popular sites goodwesite.com as I penetrate the leaking test tool. In flaws in the excavation process, I've invented the Web PresenceSQL injectionandXSSflaws. The official start of the article content, let's first briefly understand...

Addressing Data Across Borders for the GDPR

Most enterprises today do business across the globe, have databases in multiple countries and DBAs or users in different regions who have access to those databases. With GDPR mandating privacy requirements for personal data of European Union EU residents and visitors, it is important for an...

ICSMA-17-229-01_Philips' DoseWise Portal Vulnerabilities

OVERVIEW Philips has identified Hard-coded Credentials and Cleartext Storage of Sensitive Information vulnerabilities in Philips’ DoseWise Portal DWP web application. Philips has updated product documentation and produced a new version that mitigates these vulnerabilities. These vulnerabilities...

CVE-2017-7546

CVE-2017-7546 affects PostgreSQL versions prior to 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4, due to an incorrect authentication flaw that allows remote attackers to gain access to accounts with an empty password. Upstream fixed versions are 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4; vendor advisori...

CVE-2017-10120

Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Select Any Dictionary privilege with logon to the infrastructure where RDBMS...

CVE-2017-10120

Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Select Any Dictionary privilege with logon to the infrastructure where RDBMS...

WakaTime: Failure to check password history

I discovered that old passwords could be reused and believe that wakatime.com could benefit if there was a check for old passwords in your database. Because password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period ...

CVE-2017-11614

CVE-2017-11614 involves MEDHOST Connex hard-coded IBM i DB2 user credentials (HMSCXPDN). The vulnerability arises because the password is embedded in multiple locations in the Connex application and cannot be changed by customers, and the account has elevated DB2 roles enabling access to all obje...

The vulnerability of the getNodeSize function in the SQLite database management system allows attackers to carry out other attacks.

The vulnerability of the getNodeSize function in the SQLite database management system arises from the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to exert other effects using the reduced size of RTree blobs within the...

Unspecified Vulnerability in Oracle Database Server (CNVD-2017-18568)

Oracle Database Server is an object-relational database management system. It provides an open, comprehensive, and integrated approach to information management. Oracle Database Server version 12.1.0.2 has a security vulnerability in the RDBMS Security implementation, which can be exploited by a...

CVE-2017-11174

CVE-2017-11174 is a SQL injection vulnerability affecting XOOPS Core 2.5.8.1, in the file install/page_dbsettings.php. The issue arises from unfiltered data being passed to CREATE and ALTER SQL queries, with a specific relation to GBK in CHARACTER SET and COLLATE clauses. The vulnerability allows...

CVE-2017-6022

A hard-coded password issue was discovered in Becton, Dickinson and Company BD PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use hard-coded passwords to access the BD Kiestra Database, which could be leveraged to compromise the...

CVE-2016-4383

The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change...

CVE-2017-7314

CVE-2017-7314 affects Personify360 e-Business, versions 7.5.2–7.6.1. While creating a new role at /TabId/275, an attacker could access a list of database tables and their columns, revealing schema information due to improper access restrictions. ExploitDB evidence documents a PoC showing schema d...