7248 matches found
CVE-2017-5962
An issue was discovered in contextswurfl for TYPO3 before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the "forceua" HTTP GET parameter passed to the "/contextswurfl/Library/wurfl-dbapi-1.4.4.0/checkwurfl.php" URL. An attacker could execute arbitrary HTM...
CVE-2017-5963
An issue was discovered in caddy for TYPO3 before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the “paymillToken” HTTP POST parameter passed to the “caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php” URL. An attacker could execute...
Muviko Video CMS - SQL Injection
Muviko Video CMS - SQL Injection Exploit Title: Muviko Video CMS Script - SQL Injection Google Dork: N/A Date: 08.02.2017 Vendor Homepage: https://muvikoscript.com/ Software Buy: https://codecanyon.net/item/muviko-movie-video-cms/19402086 Demo: https://demo.muvikoscript.com/ Version: N/A Tested o...
Cross site request forgery (csrf)
IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request...
CVE-2016-6090
Technical details (affected product, component, root cause, impact specifics, or fix) for CVE-2016-6090 are not publicly available in the provided documents. Monitor for updates and additional disclosures.
CVE-2016-5949
IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request...
Joomla! 3.6.4 - Admin TakeOver Exploit
Exploit for php platform in category web applications !/usr/bin/python3 CVE-2016-9838: Joomla! = 3.6.4 Admin TakeOver cf import bs4 import requests import random ADMINID = 384 url = 'http://vmweb.lan/Joomla-3.6.4/' formurl = url + 'index.php/component/users/?view=registration' actionurl = url +...
Persistent Cross-site Scripting (XSS)
ghost is vulnerable to persistent cross-site scripting XSS. This is because it fails to sanitize user data, thus making it possible for an attacker to supply crafted input in order to harm third party users...
Ghost Blog 0.11.3 Cross Site Scripting
===== Tempest Security Intelligence - ADV-9/2017 ======================== Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents...
iucode-tool buffer overflow vulnerability
iucode-tool is a set of microcode tools for operating Intel-registered i686 and X86-64 system processors. A heap buffer overflow vulnerability exists in iucode-tool versions 1.4 through 2.1, which originates when the program fails to properly perform bounds detection on user-submitted data,...
WordPress < 4.7.1 Multiple Vulnerabilities
Binary data 9894.prm...
CVE-2016-10137
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the...
Design/Logic Flaw
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups.fota.sysoper. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of...
CVE-2016-10139
The CVE-2016-10139 issue affects BLU R1 HD devices running Shanghai Adups software. The com.adups.fota.sysoper app declares android:sharedUserId as android.uid.system, allowing it to run as the privileged system user and grant additional permissions not listed in its manifest. This enables access...
Hello Kitty Database of 3.3 Million Users Surfaces
A cache of data including 3.3 million user credentials belonging to Hello Kitty parent company Sanrio surfaced over the weekend. The breach was originally reported in December 2015, but at the time Sanrio denied any data was stolen as part of the breach. The breach was tied to a misconfigured...
Showmax: Changing details of other users profile using UUID (IDOR)
Access token uniquely maps to particular user record, which is then the only one accessible to user when doing API calls. Issue arise when intermediate service had used service token to update the user record. That allowed accessing user details of other user that the current access token belongs...
Cross-site Scripting (XSS)
jquery-migrate is vulnerable to Cross-site Scripting XSS. jquery-migrate uses code similar to $location.hash to select an ID value encoded on the page. However, an attacker can create a cross-site scripting injection by using a string similar to and run code to steal user data...
Memory Corruption Vulnerability in WebKit Component of Multiple Apple Products (CNVD-2016-12799)
Apple Safari, iCloud for Windows, iTunes, iOS, and tvOS are products of Apple Inc. Apple Safari is a web browser that is the default browser shipped with the Mac OS X and iOS operating systems; iTunes is a suite of media player applications. WebKit is an open source web browser engine developed b...
CVE-2016-6810
In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation...