What you didn’t know about OWASP Top-10 2017? Part 1/3

I hope everybody have already read the latest OWASP Top-10 list . Let me share some useful insights about it. First of all, OWASP Top-10 is NOT a vulnerability classification system. Rather it is a list of the most critical security risks for web application. What’s the difference? For example, t...

SQL Injection Vulnerability in XiaoCMS Backend Database.php Page

Based on PHP+Mysql architecture, XiaoCms Enterprise Builder is a small, flexible, simple and easy-to-use lightweight cms. A SQL injection vulnerability exists in the database.php page of XiaoCMS backend. An attacker can exploit this vulnerability to obtain sensitive information from the database...

Friend's Home App Has Logic Design Flaws

Friends Home App is a social B&B platform based on acquaintance relationship. There is a logical design vulnerability in the Friend's Home APP, which can be exploited by an attacker to register arbitrary accounts and reset account passwords, leading to account abuse and consumption of service...

SQL Injection Vulnerability in DuxCms 3.0

DuxCms is a small and medium-sized website builder based on PHP+MYSQL and written in CANPHP framework. DuxCms 3.0 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL injection vulnerability in the pro_content.php page of Xuchang Chunqiu Network Technology Co.

Xuchang Chunqiu Network Technology Co., Ltd. is a one-stop IT service company dedicated to website construction, network promotion, keyword optimization, 400 phone, talent network, software development and application, service outsourcing and many other businesses in one. A SQL injection...

SQL Injection Vulnerability in Yitianlian's Website Building System

Shenzhen Yitianlian Technology Co., Ltd. is a network operator providing professional network marketing services for enterprises. A SQL injection vulnerability exists in the Yitianlian Technology website builder system. Allow attackers to exploit the vulnerability to obtain sensitive information ...

SQL Injection Vulnerability in Xi'an Hongbo Network Technology Co.

Xi'an Hongbo Network Technology Co., Ltd. is a professional design team integrating network preparation, digital film and television production, and brand visual design. Xi'an Hongbo Network Technology Co., Ltd. website construction system suffers from SQL injection vulnerability. Attackers can...

flash-plugin: out-of-bounds read causing information leak (APSB18-01)

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid out-of-range pointer offset during access of internal data structure fields causes...

CVE-2018-4871

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid out-of-range pointer offset during access of internal data structure fields causes...

CVE-2018-4871

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid out-of-range pointer offset during access of internal data structure fields causes...

CVE-2018-4871

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid out-of-range pointer offset during access of internal data structure fields causes...

PT-2018-16582

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 28.0.0.137 Description An Out-of-bounds Read issue occurs due to computation that reads data past the end of the target buffer. The use of an invalid pointer offset during access of internal data structure...

SQL injection vulnerability in phpaaCMS v0.5 category.action.php page

phpaaCMS is a simple article management system. A SQL injection vulnerability exists in the /admin/category.action.php page of phpaaCMS v0.5, which can be exploited by attackers to obtain sensitive database information...

CVE-2018-4871: Out-of-bounds Read

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid out-of-range pointer offset during access of internal data structure fields causes...

IBM Tivoli Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-01128)

IBM Tivoli Key Lifecycle Manager enables you to locally create, distribute, back up, archive and manage the lifecycle of keys and certificates in your organization. An information disclosure vulnerability exists in IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7. The vulnerability arises becau...

Meltdown and Spectre: what you need to know

UPDATE as of 1/12/18: Several vendors have produced patches for Meltdown and Spectre, however performance problems dog the fixes. Details on the patches were published here. UPDATE as of 1/04/18: Since the Malwarebytes Database Update 1.0.3624, all Malwarebytes users are able to receive the...

Multiple CPUs - 'Spectre' Information Disclosure

/ EDB Note: - https://spectreattack.com/ - https://spectreattack.com/spectre.pdf - https://googleprojectzero.blogspot.co.at/2018/01/reading-privileged-memory-with-side.html / include include include ifdef MSCVER include / for rdtscp and clflush / pragma optimize"gt",on else include / for rdtscp a...

CVE-2017-9965

An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. Using a directory traversal attack, an unauthorized person can view web server files...

PHP Scripts Mall Single Theater Booking SQL Injection Vulnerability

PHP Scripts Mall Single Theater Booking is an open source theater script. PHP Scripts Mall Single Theater Booking suffers from a SQL injection vulnerability. A remote attacker can exploit this vulnerability by sending the 'movieid' parameter to the admin/movieview.php file to obtain the username ...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2018-01381)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. An information disclosure vulnerability exists in IBM Security Guardiu...