3133 matches found
CVE-2017-14848
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...
CVE-2017-14848
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...
Sql injection
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employeeid parameter...
National Cyber Security Awareness Month for Organizations
The month of October 2017 is again the National Cyber Security Awareness Month NCSAM for individuals and organizations. This year’s theme is shared responsibility which is something we’ve been talking a lot about when it comes to public cloud support for many years. This year Trend Micro will be...
WordPress WPHRM Plugin - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo:...
WordPress Plugin WPHRM - SQL Injection
WordPress Plugin WPHRM - SQL Injection Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo:...
WordPress Plugin WPHRM - SQL Injection
Exploit Title: WordPress Plugin WPHRM - SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://mojoomla.com/ Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857 Demo: http://mobilewebs.net/mojoomla/extend/wordpress/wphrm/ Version: N/A...
WordPress Student Result or Employee Database plugin <=1.6.3 - Authorization Bypass vulnerability
Authorization Bypass vulnerability found by Lim Benjamin found in WordPress Student Result or Employee Database plugin version 1.6.3 and earlier versions. Specific Google dork could find vulnerable websites. Some functions of the plugin do not check the authorization. Solution Update the WordPres...
Easy Intelligence Gathering: theHarvester
The objective of this program is to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN computer database. This tool is intended to help Penetration testers in the early stages of the penetration te...
Design/Logic Flaw
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
CVE-2017-14680
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document...
CVE-2017-14680
CVE-2017-14680 affects ZKTeco’s ZKTime Web 2.0.1.12280. The Red Hat/NVD/CNVD entries describe a vulnerability where remote attackers can obtain sensitive employee metadata by issuing a direct request for a PDF document. This indicates an improper access control/information disclosure flaw in the ...
Ayuda! (Help!) Equifax Has My Data!
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may n...
Mail.ru: Stored XSS and html injection in biz.mail.ru
Domain, site, application: biz.mail.ru Testing environment: Latest chrome Steps to reproduce 1 go to biz.mail.ru, login 2 go to "My company" 3 create a department named as "alert 4 add an employee in that department 5 create a new subdepartment 6 add the employee from step 4 in our subdepartment...
WPHRM <= 1.0 - Authenticated SQL Injection
The vulnerability allows an employee users to inject SQL commands. PoC http://localhost/PATH/?hr-dashboard=user=message=viewmessage=inbox=SQL-23+union+select 1,2,3,4,5,SELECT+GROUPCONCATtablename+SEPARATOR+0x3c62723e+FROM+INFORMATIONSCHEMA.TABLES+WHERE+TABLESCHEMA=DATABASE,7,8--%20-...
European Companies Must Tell Employees If Their Work Emails Are Being Monitored
Finally, European companies must inform employees in advance if their work email accounts are being monitored. The European Court of Human Rights ECHR on Tuesday gave a landmark judgement concerning privacy in the workplace by overturning an earlier ruling that gave employers the right to spy on...
4 steps for improving employee trust while securing them
Earlier this month we held our quarterly Cybercrime Tactics and Techniques Q2 2017 webinar. This event gave thousands of security practitioners and leaders a chance to learn about the latest analysis of threats Malwarebytes Labs has seen around the globe. In case you missed it, you can watch an...
ZKTime Web Software 2.0 - Improper Access Restrictions
ZKTime Web Software 2.0 - Improper Access Restrictions Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category:...
Partner Perspectives: 3 Three Ways to Mitigate Your Phishing Risk
Editor's Note: This blog originally appeared on redcanary.com Phishing remains one of the most common and effective means for an attacker to gain initial access to their victims’ environments. Verizon’s 2017 Data Breach Investigation Report DBIR indicated that for two years running, phishing was...