CVE-2016-5048

SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field...

CVE-2016-5048

CVE-2016-5048 affects ReadyDesk 9.1 and targets the chat/staff/default.aspx login input. The user name field is vulnerable to SQL injection, allowing remote attackers to execute arbitrary SQL commands. The vulnerability is described in multiple sources (NVD entry and CERT/CC advisory) with a high...

Shopify: Staff member can delete Private Apps

Hi Team, Bug description : I noticed that Full access staff member doesn't have access to private Apps Even he has access to Apps. But a Staff member can actually Delete Private Apps through the normal App link by changing the ID. Steps to reproduce : 1. Create A shop and install any app. Also...

DNS Analysis Tool: Bluto

The target domain is queried for MX and NS records. Sub-domains are passively gathered via NetCraft. The target domain NS records are each queried for potential Zone Transfers. If none of them gives up their spinach, Bluto will attempt to identify if SubDomain Wild Cards are being used. If they a...

Dream Gallery 1.0 - Cross-Site Request Forgery (Add Admin)

Exploit for php platform in category web applications 0day.today 2018-04-14...

Shopify: staff memeber can install apps even if have limitied access

hey ; for example staff member have limit access to orders when this memeber want install app scope readorders ,error message showed : Oauth error invalidrequest: You do not have permission to access the requested scopes bug: ----- staff memeber can install app even if have limit access to scops...

Airport Plane Ground Staff 3D - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Airport Plane Ground Staff 3D published at the 'play' market has multiple vulnerabilities...

dailyastorian.com XSS vulnerability

Vulnerable URL: http://www.dailyastorian.com/apps/pbcs.dll/section?category=staff=staffProfilePages%22/%3E%3Csvg/onload=alert%28%27XSSPOSED%27%29%3E=ebengel Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicl...

genome.gov XSS vulnerability

Vulnerable URL: https://www.genome.gov/staffSearch.cfm Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 12:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 82671 Google Pagerank| 7 VIP website status:| Yes...

ithacacityschools.org XSS vulnerability

Vulnerable URL: http://www.ithacacityschools.org/getstaff.cfm?building=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 652316 Google...

Shopify: deleted staff member can add his amazon marketplace web services account to the store.

Hi , I have found that if a staff member had access to settings for one single time , he can add his amazon marketplace web services account to the store anytime he wants even after he is deleted from the admins which allows him to fulfill orders for the online store using his own inventory store...

Shopify: Staff members with no permission can access to the files, uploaded by the administrator

Staff members with no permission can access to the files, uploaded by the administrator Test 1 If the member has access only to the section Products, Inventory, & Collections 1. Go to the Products - Product Name - Description 2. Click the button - Add Image 3. In the section Uploaded images are a...

Shopify: create staff member without owner access

Hi as you mentioned in 56726 "Only the the store owner is allowed to create new staff members" admins can't create new staff members! but with this vulnerability admins can use api to create user! steps: - get access token for one full access admin you can send request to xauth or sniff it from...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

mondovi.k12.wi.us XSS vulnerability

Open Bug Bounty ID: OBB-69730 Description| Value ---|--- Affected Website:| mondovi.k12.wi.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

esschools.k12.wi.us XSS vulnerability

Vulnerable URL: http://www.esschools.k12.wi.us/mhs/centralstaffdirectory.cfm?dosearch=1="====50=lastname=Search Details: Description| Value ---|--- Patched:| Yes, at 22.11.2017 Latest check for patch:| 22.11.2017 09:20 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

manawa.k12.wi.us XSS vulnerability

Open Bug Bounty ID: OBB-69418 Description| Value ---|--- Affected Website:| manawa.k12.wi.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

igs.k12.wi.us XSS vulnerability

Vulnerable URL: http://www.igs.k12.wi.us/staffdirectory.cfm?dosearch=1="====50=lastname=Search Details: Description| Value ---|--- Patched:| Yes, at 22.11.2017 Latest check for patch:| 22.11.2017 09:18 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / No...

mondovi.k12.wi.us XSS vulnerability

Open Bug Bounty ID: OBB-69404 Description| Value ---|--- Affected Website:| mondovi.k12.wi.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Koha 3.20.1 - Directory Traversal

Koha 3.20.1 - Directory Traversal Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor...