CVE-2019-5014

CVE-2019-5014 concerns the Winco Fireworks FireFly FW-1007 V2.0 Bluetooth Low Energy firmware, where an attacker can connect via BLE without authentication to issue launch commands. The vulnerability stems from improper access control in the BLE interface, allowing an unauthenticated attacker to ...

CVE-2019-11568

An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type...

Sql injection

An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...

CVE-2019-11567

An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...

Unrestricted file upload

An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type...

CVE-2019-11568

CVE-2019-11568 affects AikCms v2.0 . The vulnerability is a file upload issue demonstrated by an admin/navigation request (nav.php) where PHP code is uploaded as a .php file with content type application/octet-stream. The CVSS data indicates a high impact (C, I, A all HIGH) with network access an...

CVE-2019-7737

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

Cross site request forgery (csrf)

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7737

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2018-7814

A Stack-based Buffer Overflow CWE-121 vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 Gold Build 683.0 which could cause remote code to be executed when parsing a GD1 file...

Type confusion

A Type Confusion CWE-843 vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 Gold Build 683.0 on pcwin.dll which could cause remote code to be executed when parsing a GD1 file...

Trape v2.0 - People Tracker On The Internet: OSINT Analysis And Research Tool

Trape is a OSINT analysis and research tool, which allows people to track and execute intelligent social engineering attacks in real time. It was created with the aim of teaching the world how large Internet companies could obtain confidential information such as the status of sessions of their...

CVE-2018-18822

The CVE-2018-18822 issue affects Grapixel New Media v2.0 and is caused by SQL Injection through the pages.aspx pageref parameter. The vulnerability enables an attacker to manipulate backend queries due to unsanitized input, leading to potential data exposure or modification. The available referen...

CVE-2018-18487

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mtrand unsafely, resulting in predictable database backup file locations...

Sql injection

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...

Design/Logic Flaw

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mtrand unsafely, resulting in predictable database backup file locations...

CVE-2018-18487

The CVE-2018-18487 entry affects Gxlcms v2.0, specifically the database backup filename generation in \lib\admin\action\dataaction.class.php. The vulnerability stems from using mt_rand() in filename creation, causing predictable backup file locations. The documents do not provide exploit details,...

CVE-2018-18488

Gxlcms v2.0 is affected by a SQL injection in the file \lib\admin\action\dataaction.class.php via the ids[] parameter. Connected sources (NVD, RH, CNVD) describe remote exploitation with arbitrary SQL execution, with network access and no authentication required (per CVSS 3.0/2.0 vectors). No con...

CVE-2018-18488

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...

Evilginx v2.0 - Standalone Man-In-The-Middle Attack Framework Used For Phishing Login Credentials Along With Session Cookies, Allowing For The Bypass Of 2-Factor Authentication

evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server to provide...