SQL Injection Vulnerability in Shield Spirit Public Number Promotion System vip.php Page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. A SQL injection vulnerability exists in the vip.php page of Shield Spirit Public Number Promotion System. Allow attackers to exploit the vulnerability to obtain sensitive database information...

JVN#71666779: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Impact If a user accesses a malicious web page, arbitrary code may b...

An Unexpected MAPI Error Occurred - Catalog Not Found

When trying to promote to the vdisk, it says an unexpected MAPI error occured...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System reg.php Page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. A SQL injection vulnerability exists in the username parameter of the Shield Spirit public number promotion system \php\reg.php page. An attacker can exploit the vulnerability to obtain sensiti...

Shield Spirit Public Promotion System setup.php has a reinstallation vulnerability

Shield Spirit public number promotion system is mainly applied to public number promotion affiliate. A reinstallation vulnerability exists in Shield Spirit Public Promotion System setup.php. As the program fails to validate the installation, an attacker can reinstall the system by exploiting the...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System Login.php

Shield Spirit public number promotion system is mainly applied to public number promotion affiliate. A SQL injection vulnerability exists in the login.php of the Shield Spirit public number promotion system. Since the username variable in the statement gets data directly from post, it allows...

Authentication Bypass Vulnerability in Shield Spirit Public Promotion System check.php

Shield Spirit public number promotion system is mainly applied to public number promotion affiliate. An authentication bypass vulnerability exists in the Shield Spirit Public Number Promotion System check.php. It allows an attacker to gain unauthorized access to the system's administration page t...

promotion-sociale-marche.be XSS vulnerability

Vulnerable URL: http://www.promotion-sociale-marche.be/e-learning/claroline/backends/download.php?url=aHR0cDovL2cuZTxzdmcgb25sb2FkPWFsZXJ0KCJYU1NQT1NFRCIpPg==%3D=true=TOUS&7880348a71b083f9544b8331e92830aa=de5c42b513f83b302438c4e30c6df000 Details: Description| Value ---|--- Patched:| No Latest che...

Uber: Possibility to brute force invite codes in riders.uber.com

When adding new promotion codes for free rides, one could brute force invitation codes since there is no protection against brute force attacks. When going to payment page, it's possible to apply promotion code. If we intercept this request, we can brute force codes, since there is no captcha or...

telcel.com XSS vulnerability

Vulnerable URL: http://telcel.com/portal/promociones/begin.do?idModalidad=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Ealert%28/XSSPOSED/%29%3C/ScRiPt%3E=1203 Details: Description| Value ---|--- Patched:| Yes, at 18.12.2015 Latest check for patch:| 18.12.2015 01:28 GMT Vulnerability type:| XSS...

CVE-2015-6575

SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service integer overflow and memory corruption via crafted atoms in MP4 data, aka internal bug 20139950, a...

CVE-2015-6575

SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service integer overflow and memory corruption via crafted atoms in MP4 data, aka internal bug 20139950, a...

CVE-2015-6575

SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service integer overflow and memory corruption via crafted atoms in MP4 data, aka internal bug 20139950, a...

WordPress Plugin Cart66 Lite SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. Cart66 Lite plugin is an e-commerce plugin developed by cart66 for wordpress. A SQL injection vulnerability exist...

Code injection

The SAP Promotion Guidelines CRM-MKT-MPL-TPM-PPG module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors...

WordPress Facebook Promotion Generator Plugin Cross Site Scripting Vulnerability

WordPress Facebook Promotion Generator Plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

WordPress Facebook Promotion Plugin <= 1.3.4 - Multiple XSS

Because of these vulnerabilities in admin/swarm-settings.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

CVE-2013-1656

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/paymentmethodscontroller.rb; and the 2 promotionaction parameter to...

Part of the Discuz! The forum user can be any brush points-vulnerability warning-the black bar safety net

For some Discuz! Forum on the promotion visit this place not paying attention so the user can be any brush Forum user points and levels First click on the promotion to access ! You can see this interface “If you have a friend by one of the following links to access the site, you will get reward...

Spree promotion_actions_controller.rb promotion_action Parameter Arbitrary Ruby Object Instantiation Command Execution

Spree contains a flaw that is triggered when handling input passed via the 'promotionaction' parameter to promotionactionscontroller.rb. This may allow a remote authenticated attacker to instantiate arbitrary Ruby objects and potentially execute arbitrary commands...