CVE-2017-7897

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...

Cross site scripting

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...

Huawei P6 Elevation of Privilege Vulnerability

The Huawei P6 is a smartphone from the Chinese company Huawei Huawei.The EDGE-U00, EDGE-T00 and EDGE-C00 are among the versions... The Huawei P6 suffers from an elevation of privilege vulnerability. An attacker can exploit the vulnerability to perform a screenshot operation, resulting in the...

XenMobile Rest API

XenMobile provides an extensive REST API that can be leveraged to extract data and provide it for business needs. This feature provides customers with the facility of calling XenMobile services using REST API. Instead of using XenMobile console, customers can call exposed services by using any RE...

Information Disclosure

BouncyCastle is vulnerable to information disclosure attacks. Attackers can use a malicious application to obtain sensitive user information...

CVE-2016-8789

Huawei eSpace Integrated Access Device IAD with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS...

Code injection

Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 V100R001C01B508SP01 and earlier versions before V100R001C01B508SP02; EDGE-C00 V100R001C92B508SP02 and earlier versions before V100R001C92B508SP03 can capture...

CVE-2014-8571

Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 V100R001C01B508SP01 and earlier versions before V100R001C01B508SP02; EDGE-C00 V100R001C92B508SP02 and earlier versions before V100R001C92B508SP03 can capture...

CVE-2016-8789

Huawei eSpace Integrated Access Device IAD with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS...

CVE-2014-8571

Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 V100R001C01B508SP01 and earlier versions before V100R001C01B508SP02; EDGE-C00 V100R001C92B508SP02 and earlier versions before V100R001C92B508SP03 can capture...

CVE-2014-8571

CVE-2014-8571 affects Huawei Ascend P6 family (EDGE-U00, EDGE-T00, EDGE-C00) with listed builds prior to SP02/SP03; vulnerability allows screen capture without root permission, enabling potential leakage of user information by malware. Connected sources (Huawei PSIRT advisory HW-372118, CNVD-2017...

XPath Injection

XML Path Language XPath queries are used by web applications for selecting nodes from XML documents. Once selected, the value of these nodes can then be used by the application. A simple example for the use of XML documents is to store user information. As part of the authentication process, the...

Panasonic Smart Lock Android App Has Arbitrary Password Reset Vulnerability

Panasonic Smart Lock Android App is a smart hardware device. Panasonic Smart Lock Android App has an arbitrary password reset vulnerability. Allows an attacker to change the other party's password simply by knowing their cell phone number and obtain sensitive user information...

qdPM Information Disclosure Vulnerability (CNVD-2017-03454)

qdPM is a free , open source based on Symfony framework using PHP and MySQL development project management system . An information disclosure vulnerability exists in qdPM version 8.3. A remote attacker can exploit this vulnerability by sending an invalid ID value to index.php/users/info/id/ID to...

phplist 3.2.6 - SQL Injection

Introduction Affected Product: phplist 3.2.6 Fixed in: 3.3.1 Fixed Version Link: https://sourceforge.net/projects/phplist/files/phplist/3.3.1/phplist-3.3.1.zip/download Vendor Website: https://www.phplist.org/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor:...

Online Cinema And Event Booking Script 2.01 SQL Injection

Exploit Title: Online Cinema and Event Booking Script v2.01 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/online-cinema-and-event-booking-script/ Demo:...

Online Cinema and Event Booking Script 2.01 - newsid Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Cinema and Event Booking Script v2.01 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software :...

Wordpress < 4.7.1 - Username Enumeration (CVE-2017-5487)

Author: p0wd3r know Chong Yu 404 security lab Date: 2017-03-05 0x00 vulnerability overview Vulnerability description Recently exploit-db is published on a Wordpress 4.7.1 username enumeration vulnerabilities: , in fact, the vulnerability to 1-month 14, has been posted on the Internet, and given t...

Ubuntu 12.04 LTS : openjdk-6 vulnerabilities (USN-3198-1)

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

CLUB-8 EMS - SQL Injection

CLUB-8 EMS - SQL Injection Exploit Title: CLUB-8 EMS - Event Management System - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://rexbd.net/ Software Buy: https://codecanyon.net/item/club8-ems-event-management-system-a-to-z/14067759 Demo: http://ems.rexbd.net/ Version: N/A...