CVE-2016-2308

The CVE-2016-2308 vulnerability affects American Auto-Matrix Building Automation Front-End Solutions (Aspect-Nexus and Aspect-Matrix) applications prior to version 3.0.0, where passwords are stored in clear text. This enables a remote attacker to read sensitive information from a file on the host...

WordPress N-Media Post Front-end Form Plugin <= 1.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability was found in WordPress N-Media Post Front-end Form Plugin v1.0. It only validates the file on client-side with JavaScript so the validation can be easily bypassed. Solution Update the plugin...

WordPress Front End File Upload And Manager Plugin <= 3.9 - Arbitrary File Upload

This plugin is prone to an arbitrary file upload vulnerability. Solution Update the plugin...

Front end file upload and manager Plugin <= 3.9 - Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

WordPress Front End Profile Plugin <= 0.2.1 - Multiple Vulnerabilities

This plugin is prone to a privilege escalation and stored cross site scripting vulnerabilities. Solution Update the plugin...

WP Front End Profile <= 0.2.1 - Privilege Escalation & Stored Cross-Site Scripting (XSS)

It is possible to modify a POST request to overwrite user meta including 'wpcapabilities' and 'wpuserlevel' which results in a privilege escalation vulnerability. User input is not sanitised or escaped on output resulting in a stored XSS vulnerability. Timeline: 2016-09-12: Vulnerability found...

GDB Front End: PINCE

GDB Front End: PINCE is not Cheat Engine PINCE is a front-end/reverse engineering tool for the GNU Project Debugger GDB, focused on games. But it can be used for any reverse-engineering related stuff. PINCE is an abbreviation for “PINCE is not Cheat Engine”. PINCE’s GUI is heavily “inspired;D” by...

Google Chrome Access Restriction Bypass Vulnerability (CNVD-2016-03836)

Google Chrome is a web browsing tool developed by Google. In versions of Google Chrome prior to 51.0.2704.79, Blink/DevTools/WebKit/Source/devtools/frontend/devtools.js does not ensure that the remoteFrontendUrl parameter is associated with the chrome-devtools- frontend.appspot.com URL associatio...

Tipask 2.0前台任意文件删除漏洞

No description provided by source...

Tipask前台/?user/register.html无条件注入漏洞

No description provided by source...

fengcms_v1.32.beta 前台SQL注入

No description provided by source...

Coinbase: User's legal name could be changed despite front end controls being disabled

Despite the front-end form fields being disabled, a user could still change his/her legal name by manually manipulating the form in developer tools, or by manually creating a POST request with the necessary parameter names and values...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerabilities of the browser/devtools/devtoolsuibindings.cc and WebKit/Source/devtools/frontend/Runtime.js functions within the Developer Tools subsystem of the Google Chrome browser are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to...

File upload vulnerability example analysis-vulnerability warning-the black bar safety net

Principles File upload is a Web application that often appear in the function,it allows users to upload files to the server and saved to a specific location. This security is a very sensitive issue, once the malicious program is uploaded to the server and get the Execute permission, the...

Universal Analytics <= 1.3.0 - Authenticated Cross-Site Scripting (XSS)

"A subscriber could update the plugins settings via the URL or AJAX. The settings were not sanitized before saving to the database and not escaped before outputted on the front end."...

jeecms前台在/member/o_upload_image.jspx存在文件上传漏洞

No description provided by source...

YouYaX论坛前台任意账户登入（cookie伪造）漏洞

No description provided by source...

TYPO3 Front-end Component Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in the front-end component of TYPO3 versions 6.2.x before 6.2.16 and 7.x before 7.6.1. A remote attacker can exploit this vulnerabilit...

WordPress Poll Widget 1.0.7 SQL Injection

Exploit Title : wordpress poll widget version 1.0.7 SQL Injection vulnerability Author : WICS Date : 7/12/2015 Software Link : https://wordpress.org/plugins/polls-widget/ Affected Version: 1.0.7 and below Overview: Poll widget is wordpress plugin which provide fancy user Polling layout to website...

WordPress Users Ultra 1.5.50 Cross Site Scripting

Exploit Title: WordPress Users Ultra Plugin Persistence XSS Discovery Date: 2015/10/20 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link: https://wordpress.org/plugins/users-ultra/...