CVE-2016-3759

The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages priv-app access to insert a backup transport, aka internal bug 28406080...

X (Formerly Twitter): Html Injection and Possible XSS in sms-be-vip.twitter.com

Hi, I would like to report HTML Injection and possible cross site scripting XSS vulnerability in sms-be-vip.twitter.com Overview The sms-be-vip.twitter.com 404 error page appears to be vulnerable to XSS and HTML Injection as it doesn't encode the HTML tags in the path name such as...

JSON Swagger CodeGen Parameter Injector

This module generates an Open API Specification 2.0 Swagger compliant json document that includes payload insertion points in parameters. In order for the payload to be executed, an attacker must convince someone to generate code from a specially modified swagger.json file within a vulnerable...

sNews CMS 1.7.1 CSRF / Cross Site Scripting / Code Execution

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SNEWS-RCE-CSRF-XSS.txt + ISR: APPARITIONSEC Vendor: ============ snewscms.com Product: ================ sNews CMS v1.7.1 Vulnerability Type: =================================== Persistent...

ABB DataManagerPro Credential Management Vulnerability

OVERVIEW NCCIC/ICS-CERT received a report from Trend Micro’s Zero Day Initiative ZDI concerning a credential management vulnerability in ABB’s DataManagerPro application. Security researcher Andrea Micalizzi reported this vulnerability to ZDI. ABB has produced a new version to mitigate this...

PHP Code Execution

The vulnerability of the splptrheapinsert function ext/spl/splheap.c in the PHP interpreter is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by invoking the faulty operation of SplMinHeap::compare...

Stored Cross-Site Scripting Vulnerability in 78OA Office System

78OA office system is a full-featured OA office system launched by Shenzhen Xinxingkong Software for large and medium-sized enterprises and group enterprises. 78OA office system has a stored cross-site script vulnerability, an attacker can directly insert the cross-site script, and triggered by a...

Xymon Arbitrary Message Injection

The vulnerability in the lib/xymondipc.c file of the network monitoring software Xymon is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating locally, to insert arbitrary messages into the queue...

Unspecified Vulnerability in Oracle E-Business Suite Application Object Library Component

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. Oracle Application Object Library AOL, Application Object Library is one of the system management components. An unspecified vulnerability exists in t...

Oracle MySQL Server: Federated Subcomponent Denial of Service Vulnerability

Oracle MySQL is an open source relational database management system from Oracle. A security vulnerability exists in the Server: Federated subcomponent of Oracle MySQL, which can be exploited by an attacker to update, insert, or delete data, and may also cause a denial of service. The integrity a...

Django CMS 3.2.3 Filter Bypass / Script Insertion

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1821 Release Date: ============= 2016-04-14 Vulnerability Laboratory ID VL-ID: ==================================...

Perli 2.6 Filter Bypass / Script Insertion

Document Title: =============== Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1813 Release Date: ============= 2016-04-05 Vulnerability Laboratory ID VL-ID: ====================================...

Bluethrust Clan Scripts v4 R17 - Multiple Vulnerabilities

Exploit for php platform in category web applications Administrator optionsModify Current Theme" or use site.com/members/console.php?cID=61. You can then insert the PHP code of your choosing into Footer. In order to add or edit code you are required to provide a special Admin Key that was defined...

WordPress Plugin ALO EasyMail NewsLetter 2.6.01 - Cross-Site Request Forgery

WordPress Plugin ALO EasyMail NewsLetter 2.6.01 - Cross-Site Request Forgery Exploit Title: Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability Software Link: https://wordpress.org/plugins/alo-easymail/ Affected Version: 2.6.01 Exploit Author: Mohsen Lotfi Contact:...

WordPress ALO EasyMail Newsletter 2.6.01 CSRF

Exploit Title: Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability Software Link: https://wordpress.org/plugins/alo-easymail/ Affected Version: 2.6.01 Exploit Author: Mohsen Lotfi Contact: [email protected] Twitter: foxonefoxone Date: 01-16-2016 1. Descripti...

WordPress ALO EasyMail NewsLetter 2.6.01 Plugin - Cross-Site Request Forgery

Exploit for php platform in category web applications Exploit Title: Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability Software Link: https://wordpress.org/plugins/alo-easymail/ Affected Version: 2.6.01 Exploit Author: Mohsen Lotfi Contact: email protected Twitter:...

WordPress Plugin ALO EasyMail NewsLetter 2.6.01 - Cross-Site Request Forgery

Exploit Title: Wordpress ALO EasyMail Newsletter plugin cross-site request forgery vulnerability Software Link: https://wordpress.org/plugins/alo-easymail/ Affected Version: 2.6.01 Exploit Author: Mohsen Lotfi Contact: [email protected] Twitter: foxonefoxone Date: 01-16-2016 1. Descripti...

File Hub 3.3 Arbitrary File Upload / Script Insertion

Document Title: =============== File Hub v3.3 iOS Wifi - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1695 Release Date: ============= 2016-02-01 Vulnerability Laboratory ID VL-ID: ==================================== 1695...

libpng DoS

The multiple vulnerabilities in the pngsetPLTE and pnggetPLTE functions of the libpng library are caused by buffer overflows. Exploiting these vulnerabilities could allow an attacker to cause a service failure by inserting the IHDR header into a PNG image...

TYPO3 Multiple Cross-Site Scripting Vulnerabilities (Jan 2016)

TYPO3 is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...