Apache Tomcat AJP RCE Vulnerability (Ghostcat) - Active Check

Apache Tomcat is prone to a remote code execution RCE vulnerability in the AJP connector dubbed SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Directory traversal vulnerability in ad***_te***.php file of PiPiCMS PiPi Movie & TV Collection program

PiPiCMS PiPi Movie and TV Collection Program is a movie and TV station building program based on PHP+MySQL. A directory traversal vulnerability exists in the adte.php file of PiPiCMS PiPi Movie and TV Collection Program. An attacker can use the vulnerability to access the directory of any website...

TopManage OLK Cross-Site Request Forgery Vulnerability

TopManage OLK is a suite of e-commerce management solutions from TopManage Panama. A cross-site request forgery vulnerability exists in TopManage OLK version 2020. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An...

SQL Injection Vulnerability in SemCMS SE***_Qu***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEQu.php file has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive information in the database...

Microsoft Exchange Server Exchange Control Panel Fixed Cryptographic Key Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the Exchange Control Panel web application. The product fails to generate a unique...

Moodle < 3.7.2 Information Disclosure Vulnerability

Moodle is prone to an information disclosure vulnerability. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Softwar...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-10610)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a cross-site scripting vulnerability. The vulnerability stems from the WEB application'...

SQL Injection Vulnerability in SemCMS SE***_In***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEIn.php file has a SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...

IceHrm Cross-Site Request Forgery Vulnerability

IceHrm is a human resource management Hrm system. The system includes features such as employee management, leave management and payroll management. A cross-site request forgery vulnerability exists in IceHrm version 26.2.0. The vulnerability stems from the WEB application not adequately verifyin...

Lexmark Printer XSS Vulnerability (TE933)

A stored cross-site scripting vulnerability has been identified in some Lexmark devices. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Cross-Site Scripting Vulnerability in Multiple Microsemi Products

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A cross-site scripting vulnerability exists in several Microsemi products. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

Design/Logic Flaw

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

CVE-2020-7959

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

The vulnerability of the Oracle iSupport web application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTPS protocol...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-10427)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. The vulnerability stems from the lack of prope...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kali Rolling The Ic...

The vulnerability of the Oracle iSupport web application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTPS protocol...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)

Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kal...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)

Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kali Rolling The Ice HRM Web Application is vulnerable t...

phpMyChat Plus 1.98 - (pmc_username) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: phpMyChat Plus 1.98 - 'pmcusername' SQL Injection Exploit Author: J3rryBl4nks Vendor Homepage: http://ciprianmp.com/latest/ Software Link: https://sourceforge.net/projects/phpmychat/files/phpMyChatPlus/ Version MyChat Plus 1.98 Tested o...