PT-2017-10121

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description A cross-site scripting XSS issue exists in the member validation component, potentially allowing remote attackers to inject arbitrary web script or HTML...

CVE-2017-3263

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Team Member. Supported versions that are affected are 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with...

CVE-2017-3263: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Team Member. Supported versions that are affected are 8.2, 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily exploitable vulnerability allows low privileged attacker with...

SQL Injection Vulnerability in YzmCMS /member/account.php Page

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS /member/account.php page has a SQL injection vulnerability. Because the /member/account.php page does not filter parameters, an...

Stored Cross-site Scripting Vulnerability in s-cms Website Builder System

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a solution for enterprise station-building products. A stored cross-site scripting vulnerability exists in the S-CMS website builder system. Due to the lack of filtering on the /member/memberreg.asp page, an attacker can launch a...

x5music V2.0 Member Center Injection Vulnerability

x5music Free Edition is an audio-visual management system developed using php+Mysql. x5music V2.0 Free Edition has an injection vulnerability in the member center. As X5music uses a global escape filter, nickname characters are taken out of the database and not processed, resulting in data that c...

hyatt.com XSS vulnerability

Vulnerable URL: https://www.hyatt.com/content/partnerlandingpage/en/corporate/global/hyatt-member-discount.html?icamp=";alertOPENBUGBOUNTY;// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

WordPress Ultimate Member Plugin <= 1.3.75 - Unauthenticated Change Passwords

This plugin is prone to an unauthenticated change passwords vulnerability. Solution Update the plugin...

Ultimate Member < 1.3.76 - Unauthenticated Change Passwords

Ultimate Member versions below 1.3.76 contain a critical security issue that allows unauthenticated users to reset any users password to an arbitrary value...

Microsoft Joins The Linux Foundation — Turns Love Affair Into a Relationship

You won't believe your eyes while reading this, but this is true. Microsoft just joined the Linux Foundation as a high-paying Platinum member. Microsoft's love with open source community is embracing as time passes. At its first Connect event in 2013, the company launched Visual Studio 2013. A ye...

Typo3 Member Infosheets Extended SQL Injection Vulnerability

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. Typo3 Member Infosheets suffers from a SQL injection vulnerability that can be exploited by an attacker to compromise an application, access or modify data, or exploit a potential vulnerability in...

SQL Injection in extension "Member Infosheets" (if_membersheet)

It has been discovered that the extension "Member Infosheets" ifmembersheet is susceptible to SQL Injection. Release Date: November 14, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 0.1.2 and below...

ok.com XSS vulnerability

Open Bug Bounty ID: OBB-191447 Description| Value ---|--- Affected Website:| ok.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DSA-3702-1 tar - security update

Bulletin has no description...

Kerberos Security Feature Bypass

Exploit Title: Kerberos Security Feature Bypass Vulnerability Kerberos to NTLM Fallback Date: 22-09-2016 Exploit Author: Nabeel Ahmed Tested on: Windows 7 Professional x32/x64 and Windows 10 x64 CVE : CVE-2016-3237 Category: Local Exploits & Privilege Escalation SPECIAL CONFIG: Standard Domain...

Kerberos in Microsoft Windows - Security Feature Bypass (MS16-101)

Exploit for windows platform in category local exploits Exploit Title: Kerberos Security Feature Bypass Vulnerability Kerberos to NTLM Fallback Date: 22-09-2016 Exploit Author: Nabeel Ahmed Tested on: Windows 7 Professional x32/x64 and Windows 10 x64 CVE : CVE-2016-3237 Category: Local Exploits &...

PHPCMS V9 member_group.php file SQL injection vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. A SQL injection vulnerability exists in the PHPCMS V9 membergroup.php file, which allows attackers to exploit the vulnerability t...

kuvalda.ru XSS vulnerability

Vulnerable URL: http://www.kuvalda.ru/member/remind/ Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 10:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Meters in cms member\mypay.php after login, prepaid cards sql injection vulnerability

No description provided by source...

Ultimate Member < 1.3.65 - Local File Inclusion

It was discovered that Ultimate Member is vulnerable to PHP File Inclusion. In order to exploit this issue an attacker must be able to place an arbitrary PHP file on the target system. Afterwards the attacker needs to lure an authenticated admin to visit a malicious page. Through CSRF the attacke...