Hardcoded credentials

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

WordPress Job Manager 4.1.0 Cross Site Scripting

Exploit Title: Wordpress Plugin Job Manager v4.1.0 Stored Cross Site Scripting Google Dork: N/A Date: 2018-07-15 Exploit Author: Berk Dusunur & Selimcan Ozdemir Vendor Homepage: https://wpjobmanager.com Software Link: https://downloads.wordpress.org/plugin/wp-job-manager.latest-stable.zip Affecte...

Ivanti Avalanche Information Disclosure Vulnerability (CNVD-2018-12538)

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions 5.3 through 6.2, which stems from the program's use of...

CVE-2018-7528: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an attacker to alter stored data...

PT-2018-18133

Name of the Vulnerable Software and Affected Versions Geutebruck G-Cam/EFD-2250 version 1.12.0.4 Topline TopFD-2125 version 3.15.1 Description An SQL injection issue has been identified, which may allow an attacker to alter stored data. Recommendations For Geutebruck G-Cam/EFD-2250 version...

Etcd Keys API Information Gathering

This module queries the etcd API to recursively retrieve all of the stored key value pairs. Etcd by default does not utilize authentication. Module Options msf use auxiliary/scanner/etcd/open/keyscanner msf undefinedkeyscanner show actions ...actions... msf undefinedkeyscanner set ACTION msf...

Segmentation Fault

ZZIPlib is vulnerable to segmentation faults. Attackers can cause these faults because the zzipdiskfread function attempts to access invalid memory. It tries to do this because the size variable isn't compared against the amount of file-stored data...

DEBIAN-CVE-2018-6381

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of...

UBUNTU-CVE-2018-6381

In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmentation fault caused by invalid memory access in the zzipdiskfread function zzip/mmapped.c because the size variable is not validated against the amount of...

Procter&Gamble Oral-B App for Android Privilege Gain Vulnerability

Procter&Gamble Oral-B App for Android is an Android-based electric toothbrush management app from Procter&Gamble. A security vulnerability exists in version 5.0.0 of the Procter&Gamble Oral-B App for Android, which stems from the program's use of AES encryption with static parameters. An attacker...

WordPress Share This Image 1.03 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Credit Ricardo Sanchez Vulnerable Share This Image 1.03 Share This Image is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress 3rd-Party Inject Results 0.2 Cross Site Scripting Vulnerability

WordPress 3rd-Party Inject Results plugin version 0.2 suffers from a persistent cross site scripting vulnerability. Vulnerable Forms: 3rd-Party Inject Results 0.2 Forms: 3rd-Party Inject Results is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize...

CVE-2017-14941

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

Design/Logic Flaw

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

[SECURITY] Fedora 22 Update: phpMyAdmin-4.5.4-1.fc22

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

PT-2015-6509

Name of the Vulnerable Software and Affected Versions Cisco Unified Web and E-Mail Interaction Manager versions 9.02 and 11.01 Description The issue is related to improper authorization, allowing remote authenticated users to read or write to stored data. Recommendations For version 9.02, update ...

CVE-2015-4298: Improper Access Control

Cisco Unified Web and E-Mail Interaction Manager 9.02 and 11.01 improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056...

PHPMemcachedAdmin 1.2.2 Remote Code Execution Vulnerability

PHPMemcachedAdmin versions 1.2.2 and below suffer from a remote code execution vulnerability. CVE-2014-8731 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C CVSSv2 Base Score=10.0 CVSSv2 Temp Score=9.5 OWASP Top 10 classification: A1 - Injection PHPMemcachedAdmin is a web-based frontend fo...

LinkedIn Boosts Security With New Session Alert and Privacy Control Tools

With a need to give more controls in users’ hands, LinkedIn has introduced a few new security features that the company says will help users of the social network for professionals keep their accounts and data more secure. SESSION ALERTS Just like Google, Facebook, Yahoo and other online services...

Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities

Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities Exploit Title: Pro Chat Rooms v8.2.0 - Multiple Vulnerabilities Google Dork: intitle:"Powered by Pro Chat Rooms" Date: 5 August 2014 Exploit Author: Mike Manzotti @ Dionach Ltd Vendor Homepage: http://prochatrooms.com Software Link:...