Haraj v2 Script Shell Upload Vulnerability

Exploit for php platform in category web applications |----------------------------| | xBADGIRL21 | | N3W PUBLIC 3XPL0IT | | , | | 0day T == -- | | /-' | | // | | x21 | |----------------------------| | Exploit Title : Haraj v2 Script Shell Upload Vulnerability | Exploit Author : xBADGIRL21 | Dork...

Haraj v2 Script SQL injection Vulnerability

Exploit for php platform in category web applications |----------------------------| | xBADGIRL21 | | N3W PUBLIC 3XPL0IT | | , | | 0day T == -- | | /-' | | // | | x21 | |----------------------------| | Exploit Title : Haraj v2 Script SQL injection Vulnerability | Exploit Author : xBADGIRL21 | Dor...

CVE-2017-5487

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

CVE-2017-5487: Exposure of Sensitive Information to an Unauthorized Actor

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

PT-2017-16528

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7 through 4.7.0 Description The issue allows remote attackers to obtain sensitive information. This is due to the REST API implementation not properly restricting listings of post authors. Attackers can exploit this via a...

TP-LINK TDDP - Multiple Vulnerabilities

TP-LINK TDDP - Multiple Vulnerabilities 1. Advisory Information Title: TP-LINK TDDP Multiple Vulnerabilities Advisory ID: CORE-2016-0007 Advisory URL: http://www.coresecurity.com/advisories/tp-link-tddp-multiple-vulnerabilities Date published: 2016-11-21 Date of last update: 2016-11-18 Vendors...

CVE-2016-5390

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the viewhosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces...

CVE-2016-5390: Exposure of Sensitive Information to an Unauthorized Actor

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the viewhosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces...

PT-2016-6404

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.1 Description The issue allows remote authenticated users with specific permissions to obtain sensitive network interface information. This can be achieved via a request to...

SonarQube Jenkins Password Disclosure

Advisory Information Title: SonarQube Jenkins Plugin - Plain Text Password Date published: 2013-12-05 Date of last update: 2013-12-05 Vendors contacted : SonarQube and Jenkins CI Discovered by: Christian Catalano Severity: High 2. Vulnerability Information CVE reference: CVE-2013-5676 CVSS v2...

CVE-2016-2065

The CVE-2016-2065 entry concerns the MSM QDSP6 audio driver (sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c) in the Linux kernel 3.x, used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices. The flaw arises from incorrect use of a parameters pointer when handling an ioctl...

CVE-2016-2064: Out-of-bounds Read

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to cause a denial of service buffer over-read or possibly have unspecified...

Security update for MozillaFirefox, mozilla-nss (important)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included: - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...

OpenSNS v2 \Application\People\Controller\IndexController.class.php parameters arearank, the parameter uid SQL injection

No description provided by source...

V2视频会议系统 /Conf/jsp/systembulletin/bulletinAction.do sysId参数SQL注入漏洞

No description provided by source...

Lindon-EDU V2 数字校园平台 /code/teach/class/classcourse.aspx 参数SubjectID SQL注入漏洞

No description provided by source...

威速科技官网某子站SQL注入可提权服务器

简要描述： 详细说明： 第三方会议系统，V2 Conference. 见: WooYun: V2视频会议系统某处SQL注射、XXE漏洞可getshell 漏洞证明： http://zuyong.v2tech.com/Conf/jsp/systembulletin/bulletinAction.do?operator=details&sysId=-1%20union%20select%201,user%28%29,3,version%28%29,5%23 mysql root权限注入，可写shell. 查看远程桌面端口：39556 创建了wooyun用户，连接远程桌面： img...

Hexchat IRC Client 2.11.0 - Directory Traversal

Hexchat IRC Client 2.11.0 - Directory Traversal !/usr/bin/python Meta information Exploit Title: Hexchat IRC client - Server name log directory traversal Date: 2016-01-26 Exploit Author: PizzaHatHacker Vendor Homepage: https://hexchat.github.io/index.html Software Link:...

FanApp v2 for RB Leipzig - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application FanApp v2 for RB Leipzig published at the 'play' market has multiple vulnerabilities...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities could allow a remote attacker to create a denial-of-service condition. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply...