InvoicePlane 1.4.10 File Upload / Cross Site Scripting Vulnerabilities

InvoicePlane version 1.4.10 suffers from cross site scripting and remote file upload vulnerabilities. title: Arbitrary File Upload & Stored XSS product: InvoicePlane vulnerable version: 1.4.10 fixed version: 1.5.2 CVE number: - impact: High homepage: https://invoiceplane.com/ found: 2017-04-10 by...

Threat Outbreak Alert RuleID29182: Email Messages Distributing Malicious Software on May 19, 2017

Medium Alert ID: 53899 First Published: 2017 May 20 03:07 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29182 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID29123: Email Messages Distributing Malicious Software on May 15, 2017

Medium Alert ID: 53833 First Published: 2017 May 15 20:01 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29123 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID29034: Email Messages Distributing Malicious Software on May 9, 2017

Medium Alert ID: 53778 First Published: 2017 May 9 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29034 may contain the following files: Name | Size ...

Threat Outbreak Alert RuleID28887: Email Messages Distributing Malicious Software on April 25, 2017

Medium Alert ID: 53564 First Published: 2017 April 25 15:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28887 may contain the following files: Name | Si...

CVE-2017-3254

Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 12.0 and 13.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail...

Design/Logic Flaw

Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 12.0 and 13.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail...

CVE-2017-3254

Vulnerability in the Oracle Retail Invoice Matching component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 12.0 and 13.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail...

CVE-2017-3254

CVE-2017-3254 affects Oracle Retail Invoice Matching (Security subcomponent) in Oracle Retail Applications, versions 12.0 and 13.0. An unauthenticated network attacker with HTTP access can compromise the component; attacks require user interaction and may lead to unauthorized data access and data...

Harvest: Client can redirect payment, causing payment discrepancy between Harvest and PayPal

Vulnerability details When a client views an invoice through the web interface, it'll show a "Pay with PayPal" button when a standard PayPal integration has been enabled. Clicking this button will submit a POST request to PayPal. This request contains a business parameter, which is the receiver o...

Invoice Template - hash SQL Injection

Invoice Template - hash SQL Injection Exploit Title: Invoice Template v1.0 for PHPRunner/ASPRunnerPro/ASPRunner.NET. - SQL Injection Google Dork: N/A Date: 07.04.2017 Vendor Homepage: https://xlinesoft.com/ Software: https://xlinesoft.com/invoice Demo:...

Invoice Template - hash Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Invoice Template v1.0 for PHPRunner/ASPRunnerPro/ASPRunner.NET. - SQL Injection Google Dork: N/A Date: 07.04.2017 Vendor Homepage: https://xlinesoft.com/ Software: https://xlinesoft.com/invoice Demo:...

Invoice Template - 'hash' SQL Injection

Exploit Title: Invoice Template v1.0 for PHPRunner/ASPRunnerPro/ASPRunner.NET. - SQL Injection Google Dork: N/A Date: 07.04.2017 Vendor Homepage: https://xlinesoft.com/ Software: https://xlinesoft.com/invoice Demo: https://xlinesoft.com/livedemo/invoice/livedemo1/ Version: 1.0 Tested on: Win7 x64...

Threat Outbreak Alert RuleID28408: Email Messages Distributing Malicious Software on March 22, 2017

Medium Alert ID: 53118 First Published: 2017 March 22 14:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28408 may contain the following files: Name | Si...

Threat Outbreak Alert RuleID28368: Email Messages Distributing Malicious Software on March 16, 2017

Medium Alert ID: 53055 First Published: 2017 March 16 15:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28368 may contain the following files: Name | Si...

Car Workshop System - SQL Injection

Car Workshop System - SQL Injection Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version: N/A Tested on: Win...

Car Workshop System SQL Injection

Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version: N/A Tested on: Win7 x64, Kali Linux x64 Exploit Author...

Car Workshop System - SQL Injection

Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version: N/A Tested on: Win7 x64, Kali Linux x64 Exploit Author...

Threat Outbreak Alert RuleID28130: Email Messages Distributing Malicious Software on March 3, 2017

Medium Alert ID: 52877 First Published: 2017 March 3 17:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28130 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID28097: Email Messages Distributing Malicious Software on March 2, 2017

Medium Alert ID: 52856 First Published: 2017 March 2 19:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28097 may contain the following files: Name | Siz...