CVE-2019-17428

An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted...

CVE-2019-6182

A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator LXCA versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted formulas stored in an exported CSV file. The crafted formul...

CVE-2019-10386

A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptordoTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi...

Memory Leak

inquirer is vulnerable to memory leak due to listeners not being removed when the prompt closes. This allows an attacker to read stored data that is not removed or initiate a denial of service by consuming too much memory...

Design/Logic Flaw

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 5, and 5u1 to 5u13 allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors...

JVN#56542712: Multiple vulnerabilities in Nablarch

Nablarch provided by TIS Inc. contains multiple vulnerabilities listed below. The vulnerability in the function of generic formatter by XXE attacks CWE-611 - CVE-2019-5918 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H| Base Score: 8.2 CVSS v2|...

CVE-2017-13102

Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Hardcoded credentials

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

WordPress Job Manager 4.1.0 Cross Site Scripting

Exploit Title: Wordpress Plugin Job Manager v4.1.0 Stored Cross Site Scripting Google Dork: N/A Date: 2018-07-15 Exploit Author: Berk Dusunur & Selimcan Ozdemir Vendor Homepage: https://wpjobmanager.com Software Link: https://downloads.wordpress.org/plugin/wp-job-manager.latest-stable.zip Affecte...

Ivanti Avalanche Information Disclosure Vulnerability (CNVD-2018-12538)

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions 5.3 through 6.2, which stems from the program's use of...

Etcd Keys API Information Gathering

This module queries the etcd API to recursively retrieve all of the stored key value pairs. Etcd by default does not utilize authentication. Module Options msf use auxiliary/scanner/etcd/open/keyscanner msf undefinedkeyscanner show actions ...actions... msf undefinedkeyscanner set ACTION msf...

Segmentation Fault

ZZIPlib is vulnerable to segmentation faults. Attackers can cause these faults because the zzipdiskfread function attempts to access invalid memory. It tries to do this because the size variable isn't compared against the amount of file-stored data...

DEBIAN-CVE-2018-6381

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of...

UBUNTU-CVE-2018-6381

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of...

Procter&Gamble Oral-B App for Android Privilege Gain Vulnerability

Procter&Gamble Oral-B App for Android is an Android-based electric toothbrush management app from Procter&Gamble. A security vulnerability exists in version 5.0.0 of the Procter&Gamble Oral-B App for Android, which stems from the program's use of AES encryption with static parameters. An attacker...

WordPress Share This Image 1.03 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Credit Ricardo Sanchez Vulnerable Share This Image 1.03 Share This Image is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress 3rd-Party Inject Results 0.2 Cross Site Scripting Vulnerability

WordPress 3rd-Party Inject Results plugin version 0.2 suffers from a persistent cross site scripting vulnerability. Vulnerable Forms: 3rd-Party Inject Results 0.2 Forms: 3rd-Party Inject Results is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize...

CVE-2017-14941

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

Design/Logic Flaw

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

[SECURITY] Fedora 22 Update: phpMyAdmin-4.5.4-1.fc22

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...