Critical Moodle Vulnerability Could Lead to Server Compromise

A critical vulnerability in Moodle, an open source PHP-based learning management system deployed across scores of schools and universities, could expose the server its running on to compromise. Tens of thousands of universities worldwide, including the California State University system, the...

Bull / IBM AIX Clusterwatch/Watchware - Multiple Vulnerabilities

Exploit for cgi platform in category web applications Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries and we...

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries...

CVE-2016-3127

An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain...

CVE-2016-3127

An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain...

Arbitrary File Upload Vulnerability in eWebEditor Editor of Fuzhou Extreme Software Development Co.

Fuzhou Extreme Software Development Co. eWebEditor editor is a browser-based online HTML editor. An arbitrary file upload vulnerability exists in the eWebEditor editor of Fuzhou Extreme Software Development Co. Due to logging into the backend via anonymous access or weak account/password...

132 Google Play Apps Booted For Having Malicious IFrames

Google removed 132 apps infected with malicious iFrames from its Google Play store after security researchers discovered a development platform used to create the apps was infected with malware and in turn compromised the apps. Palo Alto Networks’ Unit 42 researchers said the apps were infected...

CVE-2016-8931

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server...

WordPress CM Download Manager Code Injection (CVE-2014-8877)

Content Management Download Manager for WordPress is prone to remote PHP-code execution vulnerability because it fails to validate user input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. This may aid in further attacks or lead to a full...

CVE-2017-3273

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DDL. Supported versions that are affected are 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2017-3313

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: MyISAM. Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure wher...

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

A security researcher recently reported a critical vulnerability in one of the most popular open source PHP libraries used to send emails that allowed a remote attacker to execute arbitrary code in the context of the web server and compromise a web application. Disclosed by Polish security...

SQL Injection Vulnerability in Shenzhen Siquan CRM System

Ltd. is engaged in OA, CRM, ERP, HRM, enterprise mailbox system consulting and services. A SQL injection vulnerability exists in Shenzhen SiQuan CRM system. The lack of filtering of the 'username' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the...

Arbitrary File Upload Vulnerability in ucms

UCMS is an open source content management system that can be used to develop a variety of various enterprise stations, article stations and station systems. ucms background file management system file upload vulnerability. As the program does not judge the upload file, allowing attackers to explo...

Critical MySQL Vulnerabilities Can Lead to Server Compromise

Critical vulnerabilities in MySQL and vendor deployments by database servers MariaDB and PerconaDB have been identified that can lead to arbitrary code execution, root privilege escalation and server compromise. Dawid Golunski of Legal Hackers published details around two proof-of-concept exploit...

PHP Support Tickets 1.3 Local File Inclusion

PHPSTicketsv1.3 File Inclusion Vulnerability ================================================ Discovered by NA, NAattutanota.com ======================================= Description ============ PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its...

File Upload Vulnerability in X6CMS System

X6CMS, fully known as Xiaoliu Website Content Management System, is a fully functional marketing website management platform. X6CMS system has a file upload vulnerability, which can directly upload malicious script files to control the server...

Exponent CMS 2.3.9 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2016-005 - Original release date: September 09, 2016 - Last revised: September 20, 2016 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2016-7400...

Patched ColdFusion Flaw Exposes Applications to Attack

An Adobe ColdFusion vulnerability addressed Tuesday in a hotfix pushed to users put applications developed on the platform at risk to a number of serious issues. Researcher Dawid Golunski of Legal Hackers today revealed details on the flaw, which he privately disclosed to Adobe, as well as a...

Red Hat JBoss Operations Network Remote Code Execution Vulnerability (CNVD-2016-06652)

Red Hat JBoss Operations Network JON is the United States Red Hat Red Hat a J2EE-based open source application server, it can deploy, manage, monitor JBoss enterprise middleware, applications and services. A remote code execution vulnerability exists in Red Hat JON. An attacker could exploit this...