Sql injection

SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php...

CVE-2015-6915

The CVE-2015-6915 entry concerns Montala Limited ResourceSpace (open source DAM) up to version 7.3.7009 and earlier. The vulnerability is a SQL injection in the plugins/feedback/pages/feedback.php handler, exploitable via the "user" cookie. This is a server-side issue that allows remote attackers...

ZyXEL ZyWALL USG client side authorization config disclosure

Details ======= Product: ZyXEL USG Unified Security Gateway appliances ZyWALL USG-20 ZyWALL USG-20W ZyWALL USG-50 ZyWALL USG-100 ZyWALL USG-200 ZyWALL USG-300 ZyWALL USG-1000 ZyWALL USG-1050 ZyWALL USG-2000 Possibly other ZLD-based products Affected Versions: Firmware Releases before April 25, 20...

printk is not rate-limited in xenmem_add_to_physmap_one

ISSUE DESCRIPTION XENMAPSPACEgmfnforeign dumps the p2m, on ARM, when it fails to get a reference on the foreign page. However, dumpp2mlookup does not use rate-limited printk. A malicious infrastructure domain, which is allowed to map memory of a foreign guest, would be able to flood the Xen...

ResourceSpace CMS 7.3.7009 SQL Injection

Title: Blind boolean sql injection vulnerability in ResourceSpace CMS Author: William F. Reyor III Contact: [email protected] Published: August 22 2015 Vendor: Montala Limited Vendor url: www.resourcespace.org Software: ResourceSpace Digital Asset Management Software Versions: 7.3.7009 and pri...

ResourceSpace CMS 7.3.7009 SQL Injection Vulnerability

ResourceSpace CMS versions 7.3.7009 and below suffer from a remote SQL injection vulnerability. Title: Blind boolean sql injection vulnerability in ResourceSpace CMS Author: William F. Reyor III Contact: email protected Published: August 22 2015 Vendor: Montala Limited Vendor url:...

CVE-2015-3733

WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVE...

CVE-2015-3738

WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVE...

mbedTLS/PolarSSL -- multiple vulnerabilities

ARM Limited reports: In order to strengthen the minimum requirements for connections and to protect against the Logjam attack, the minimum size of Diffie-Hellman parameters accepted by the client has been increased to 1024 bits. In addition the default size for the Diffie-Hellman parameters on th...

Researchers to Share Details of Cyber-Terrorists Targeting Indian Government Officials

The Potential threat, range from very narrow to very broad, posed by Cyber-Terrorism has provoked considerable alarm. Terrorists involved in Cyber Espionage and Operations aim at gaining access to Nation's critical infrastructure involving both Government as well as Private sectors. The Frequency...

BDINFOBIZ LIMITED Bypass Admin Page Vulnerability

Exploit for php platform in category web applications +++++++++++++++ + Exploit Title : BDINFOBIZ LIMITED Bypass Admin Page Vulnerability + Exploit Author : Ashiyane Digital Security Team + Vendor Homepage : http://www.bdinfobiz.com/ + Date: 2015-07-29 + Google Dork : intext:"Developed by BDINFOB...

Pimcore CMS Build 3450 Directory Traversal

Vulnerability title: Directory Traversal/Configuration Update In Pimcore CMS CVE: CVE-2015-4425 Vendor: Pimcore Product: Pimcore CMS Affected version: Build 3450 Fixed version: Build 3473 Reported by: Josh Foote Details: It is possible for an administrative user with the 'assets' permission to...

Grandstream GXV3275 SSH Key / Command Execution Vulnerability

Grandstream GXV3275 ships with a default root SSH key which could be used a backdoor. It also suffers from an issue where restricted commands can be leveraged to break out into a full shell. The Grandstream GXV3275 is an Android-based VoIP phone. Several vulnerabilities were found affecting this...

World’s First 200GB microSD Card Arrives

There isn't any troll in the title. The "World's Largest microSD" card sized at 200GB is now officially available for purchasing from Amazon and number of retailers. So, Is your 16GB, or 32GB, or even 64GB smartphone not enough to store all your data in one place? Order a Sandisk's new...

CVE-2015-3648

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

Directory traversal

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

CVE-2015-3648

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the defaultlanguage parameter...

CVE-2015-3648

ResourceSpace (Montala Limited) is affected by a Local File Inclusion in pages/setup.php due to insufficient sanitization of the defaultlanguage parameter, allowing remote attackers to include and execute local files. The issue affects ResourceSpace up to version 7.2.6727 (vendor advisory referen...

Local PHP File Inclusion in ResourceSpace

Advisory ID: HTB23258 Product: ResourceSpace Vendor: Montala Limited Vulnerable Versions: 7.1.6513 and probably prior Tested Version: 7.1.6513 Advisory Publication: May 6, 2015 without technical details Vendor Notification: May 6, 2015 Vendor Patch: June 1, 2015 Public Disclosure: June 3, 2015...

ResourceSpace 7.1.6513 Local File Inclusion Vulnerability

ResourceSpace version 7.1.6513 suffers from a local file inclusion vulnerability. Product: ResourceSpace Vendor: Montala Limited Vulnerable Versions: 7.1.6513 and probably prior Tested Version: 7.1.6513 Advisory Publication: May 6, 2015 without technical details Vendor Notification: May 6, 2015...