Hospital Management System SQL注入漏洞

Hospital Management System HMS is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to a SQL injection vulnerability that originates in the adminlogin. A SQL injection issue...

U.S. Dept Of Defense: Full Account Take-Over of ████████ Members via IDOR

Summary https://███████ is a Social Network Site belonging to US DoD. Membership is open to anyone, I have found a method to fully take-over any members' account by exploiting an IDOR bug in the ██████████ end-point. By changing the following values in the POST request to the affected end-point:...

PT-2019-12207

Name of the Vulnerable Software and Affected Versions EXCELLENT INFOTEK BiYan versions 1.57 through 2.8 Description The issue allows an attacker to leak user information without authentication by sending a LOGIN ID element to the "auth/main/asp/check user login info.aspx" API endpoint and then...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-12760)

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in IBM API Connect versions 2018.1 through 2018.4.1.2. An attack...

PT-2019-16865 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 2018.1 through 2018.4.1.2 Description: The issue allows unauthenticated users to discover login ids of registered users by leveraging IBM API Connect apis. Recommendations: For IBM API Connect versions 2018.1 through...

CVE-2019-4052: Undefined Security Weakness

IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544...

DC Scripts DCShop Beta 1.0 02 File Disclosure Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/2889/exploit DCShop is a GCI-based ecommerce system from DCScripts. Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data,...

Invision Power Board 2.0.3 - 'login.php' SQL Injection (Tutorial)

danica jones Tutorial for the recent exploit released by Petey Beege. 1. Get the exploit from http://www.milw0rm.com/id.php?id=1013 https://www.exploit-db.com/exploits/1013/ 2. Make sure you have LWP::UserAgent perl module if not do this: a. perl -MCPAN -e 'shell' b. inside the perl shell, do thi...