tomcat: security manager bypass via JSP Servlet config parameters

It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

Mini CMS 1.1 - name SQL Injection

Mini CMS 1.1 - name SQL Injection Exploit Mini CMS v1.1 - SQL Injection Google Dork: N/A Date: 07.03.2017 Vendor Homepage: http://www.icloudcenter.com/ Software : http://www.icloudcenter.com/minicms.htm Demo: http://www.icloudcenter.net/demos/minicms/ Version: 1.1 Tested on: Win7 x64, Kali Linux...

Mini CMS 1.1 - 'name' SQL Injection

Exploit Mini CMS v1.1 - SQL Injection Google Dork: N/A Date: 07.03.2017 Vendor Homepage: http://www.icloudcenter.com/ Software : http://www.icloudcenter.com/minicms.htm Demo: http://www.icloudcenter.net/demos/minicms/ Version: 1.1 Tested on: Win7 x64, Kali Linux x64 Exploit Author: Ihsan Sencan...

Yellow Pages Clone Script 1.3.4 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Yellow Pages Clone Script v1.3.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/yellow-pages-clone-script/ Demo:...

Yellow Pages Clone 1.3.4 SQL Injection

Exploit Title: Yellow Pages Clone Script v1.3.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/yellow-pages-clone-script/ Demo: http://dexteritysolution.com/demo/directory/ Version: 1.3.4 Tested on...

Yellow Pages Clone Script 1.3.4 - SQL Injection

Exploit Title: Yellow Pages Clone Script v1.3.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/yellow-pages-clone-script/ Demo: http://dexteritysolution.com/demo/directory/ Version: 1.3.4 Tested on...

Yellow Pages Clone Script 1.3.4 - SQL Injection

Yellow Pages Clone Script 1.3.4 - SQL Injection Exploit Title: Yellow Pages Clone Script v1.3.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/yellow-pages-clone-script/ Demo:...

Cross site scripting

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6468

In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records...

CVE-2017-6397

An issue was discovered in FlightAirMap v1.0-beta.10. The vulnerability exists due to insufficient filtration of user-supplied data in multiple parameters passed to several -sub-menu.php pages. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable...

The vulnerability of Google Chrome browser allows a hacker to access certain elements of the user interface.

The vulnerability of the Blink component in Google Chrome relates to the inability to prevent certain user interface elements from being displayed on invisible pages. Exploiting this vulnerability allows a malicious actor to view certain unregulated user interface elements using a specially craft...

WordPress Magic Fields 1 plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress Magic Fields 1 plugin, which allows an attacker to frame malicio...

The vulnerability of the iOS operating system and the Safari browser allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the WebKit component of the iOS operating system and the Safari browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption,...

[SECURITY] Fedora 24 Update: tomcat-8.0.41-1.fc24

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

HackerOne: Subdomain takeover #2 at info.hacker.one

Summary: Hi team, looking the fix released from unbounce team at https://hackerone.com/reports/202767 i've been able to bypass it and takeover again the subdomain info.hacker.one with a new Vulnerable-Endpoint at UnbouncePages App Actual Dns Entry: F164154 Steps To Reproduce & New PoC for HackerO...

CVE-2017-3840

CVE-2017-3840 is a open redirect vulnerability in the web interface of Cisco Secure Access Control System (ACS). An unauthenticated remote attacker could cause a user to be redirected to a malicious URL due to improper input validation of HTTP parameters. The issue affects Cisco ACS and is docume...

CVE-2017-6059

A text injection flaw was found in how modauthopenidc handled error pages. An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs...