What We Can Learn from the Capital One Hack

On Monday, a former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. Since then, many have speculated the breach was perhaps the result of a previously unknown "zero-day" flaw, or an "insider" attack in which the accus...

Qualys Cloud Platform 2.40 New Features

This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...

Sar2HTML 3.2.1 - Remote Command Execution

Sar2HTML 3.2.1 - Remote Command Execution Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web...

College Notes Management System 1.0 Cross Site Request Forgery

Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 3, 2019 Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/ Software Link:...

Sar2HTML 3.2.1 - Remote Command Execution

Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application you will see index.php?plot url...

Sar2HTML 3.2.1 - Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: sar2html Remote Code Execution Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application y...

WordPress Fastest Cache Plugin < 0.8.9.6 Directory Traversal Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

WallacePOS Cross-Site Request Forgery Vulnerability

WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site request forgery vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from...

SAP Information Steward Cross-Site Scripting Execution Vulnerability

SAP Information Steward is a data management and integrity solution from SAP. The product supports data analysis, data along and metadata management and other functions. A cross-site scripting vulnerability exists in SAP Information Steward version 4.2. The vulnerability stems from a lack of prop...

Dolibarr <= 7.0.0 CSRF Vulnerability

Dolibarr is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Veeam ONE Reporter Cross-Site Scripting Vulnerability

Veeam ONE Reporter is part of the Veeam ONE integrated solution from Veeam Switzerland. The product is used for analytics, decision making, refunds, change tracking, capacity planning and resource utilization optimization. A cross-site scripting vulnerability exists in Veeam ONE Reporter version...

MISP Cross-Site Scripting Vulnerability (CNVD-2020-22366)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. MISP suffers from a cross-site scripting vulnerability. The vulnerability stems from a lac...

GigToDo 1.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397 Version: =...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24800)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM version 5.6.4. The vulnerability stems from the WEB application lacking...

Wikindx Cross-Site Scripting Vulnerability (CNVD-2020-22365)

Wikindx is a suite of virtual research environments online bibliography and quote/notes management and article creation system. A cross-site scripting vulnerability exists in Wikindx. The vulnerability stems from the WEB application lacking proper validation of client-side data. An attacker can...

Zurmo 3.2.6 Out Of Band Code Evaluation

Out of Band Code Evaluation Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Out of Band Code Evaluation in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Out of Band Code Evaluation Severity: Critical...

Zurmo 3.2.6 Persistent Cross Site Scripting

Stored Cross-site Scripting Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Stored Cross-site Scripting in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Stored Cross-site Scripting Severity: Medium...

Zurmo 3.2.6 Iframe Injection

Frame Injection Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Frame Injection in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Frame Injection Severity: Medium Status: Not Fixed Netsparker Advisory...

Zurmo 3.2.6 Open Redirection

Open Redirection Vulnerability in Zurmo 3.2.6 Information -------------------- Advisory by Netsparker Name: Open Redirection Vulnerability in Zurmo Affected Software: Zurmo Affected Versions: 3.2.6 Homepage: http://zurmo.org Vulnerability: Open Redirection Severity: Medium Status: Not Fixed...

Micro Focus ArcSight Security Management Center Cross-Site Scripting Vulnerability

Micro Focus ArcSight Security Management Center ArcMC is a suite of centralized security management centers from Micro Focus UK. The product focuses on managing ArcSight solutions through a single interface, including automated change management, log traffic management and other features. A...