Vtiger CRM Arbitrary File Upload Vulnerability Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. An arbitrary file upload vulnerability exists in the...

CVE-2016-4897

Multiple cross-site scripting XSS vulnerabilities in 1 filter/saveforward.cgi, 2 filter/save.cgi, 3 /man/search.cgi in Usermin before 1.690...

Code injection

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

Citrix Store Front 3.0 Unable to save favourites in Store Front

Unable to save favourites in Store Front...

SQL Injection Vulnerability in catid_save.php File of Ohu Government System

Ohuhu government system is the government portal system of Shanghai Ohuhu Network Technology Co. A SQL injection vulnerability exists in the catidsave.php file of the Ohuhu government system. An attacker can exploit the vulnerability to execute arbitrary SQL statements and obtain sensitive...

UBUNTU-CVE-2017-3157

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user in...

CVE-2017-6098

A SQL injection issue was discovered in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects /inc/campaignsave.php Requires authentication to Wordpress admin with the POST Parameter: listid...

CVE-2016-6266

cccaajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 host or 2 apikey parameter in a register action, 3 enable parameter ...

Design/Logic Flaw

cccaajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 host or 2 apikey parameter in a register action, 3 enable parameter ...

UBUNTU-CVE-2017-5381

The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. This vulnerability affects Firefox 51...

SDR-SaveRF

This is a module that could be used to save RF signals for debugging purpouses or to be replayed using a repeater, by default the destination is /tmp/saveRF !/usr/bin/env python2 -- coding: utf-8 -- GNU Radio Python Flow Graph Title: Exploit Pack - RF Hacking Author: Juan Sacco Description: RF Sa...

MC Inventory Manager Script - Multiple Vulnerabilities

Vulnerability: Admin Login Bypass & SQLi Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Inventory Manager Script Buy Now: http://microcode.ws/product/mc-inventory-manager-php-script/3885 Author: İhsan Şencan Author Web: http://ihsan.net Mail : ihsanbeygirihsannoktanet Admi...

CSRF vulnerability in icms backend

iCMS is an efficient content management system for small and medium-sized websites. A csrf vulnerability exists in the latest version of iCMS. Because the token is not validated in the /app/admincp/account.app.php dosave operation, an attacker can modify the administrator account password by...

dotCMS 'stName' Parameter SQL Injection Vulnerability

dotCMS is a content management system CMS developed in Java. A SQL injection vulnerability exists in the 'stName' parameter in dotCMS versions prior to 3.3.2, which allows remote attackers to execute arbitrary SQL commands via the stName parameter in api/content/save/1...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 description, 2 email, or 3 username parameter to user/save...

CVE-2016-5060

Multiple cross-site scripting XSS vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the 1 description, 2 email, or 3 username parameter to user/save...

DEBIAN-CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions prior...

UBUNTU-CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions prior...

la.lailaihui.com XSS vulnerability

Vulnerable URL: http://la.lailaihui.com/search/save?jsoncallback=prompt/OPENBUGBOUNTY/...

RecuperaBit - A Tool For Forensic File System Reconstruction

A software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of: missing partition table unknown partition boundaries partially-overwritten metadata quick format You ca...