emmaths.jfcs.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-622432 Description| Value ---|--- Affected Website:| emmaths.jfcs.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Brave Software: DoS in Brave browser for iOS

Summary: Attacker could initiate DoS during page loading. Products affected: 1.6 18.05.17.13 Device iPhone 6s iOS 11.3.1 Steps To Reproduce: PoC: html let o = document.body.appendChilddocument.createElement'object'; // application/json or application/pdf are valid values too o.type = 'text/html' ...

Employee Work Schedule 5.9 - cal_id SQL Injection

Employee Work Schedule 5.9 - calid SQL Injection Exploit Title: EWS 5.9 - 'search' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/employee-work-schedule-multicalendar/10545683 Version: 5.9 Category: Webapps Tested on...

Ajax Full Featured Calendar 2.0 - 'search' SQL Injection

Exploit Title: Ajax Full Featured Calendar 2.0 - 'search' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ajax-full-featured-calendar-2/10158465 Version: 2.0 Category: Webapps Tested on: Kali linux Description : The...

mySurvey 1.0 - id SQL Injection

mySurvey 1.0 - id SQL Injection Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection Dork: N/A Date: 25.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645 Version: 1.0 Category: Webapps Tested on: Kali linux Description : You can...

Tim Balitbang Depdiknas 3.5 SQL Injection

==================================================================================================================================== | Title : Tim Balitbang Depdiknas versi 3.5 Sql injection Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 FranASSais V.Pro...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

Affected versions Symfony 2.7.0 to 2.7.47, 2.8.0 to 2.8.40, 3.3.0 to 3.3.16, 3.4.0 to 3.4.10 and 4.0.0 to 4.0.10 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11. Note that no fixes are...

CVE-2018-7518

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner...

CVE-2018-7518

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner...

Default credentials

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner...

CVE-2018-7526

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access information in the application without authenticating...

CVE-2018-7526

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access information in the application without authenticating...

Information disclosure

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access information in the application without authenticating...

CVE-2018-7526

The CVE-2018-7526 vulnerability affects BeaconMedaes Scroll Medical Air Systems’ TotalAlert Web Application (software versions up to 4107600010.23). It arises from improper access control: a malicious actor can access information in the web application by requesting a specific URL without authent...

CVE-2018-7518

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner...

CVE-2018-7526

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator URL on the webserver, a malicious user may be able to access information in the application without authenticating...

CVE-2018-7518

The CVE-2018-7518 entry affects BeaconMedaes TotalAlert Scroll Medical Air Systems web application. Vulnerable component: TotalAlert Web Application; root cause: insufficient protection of credentials stored/transmitted by the integrated web server, enabling an attacker with network access to ret...

SQL Injection Discovery Tool: SleuthQL

SleuthQL is a python3 script to identify parameters and values that contain SQL-like syntax. Once identified, SleuthQL will then insert SQLMap identifiers into each parameter where the SQL-esque variables were identified. SleuthQL aims to augment an assessor’s ability to discover SQL injection...

Outpost24 Appsec Scale for Web Application Scanning

Today I would like to write about yet another Outpost24 product - cloud Web Application Scanner Appsec Scale. It is available in the same interface as Outpost24 Outscan, that I reviewed earlier. Select APPSEC SCALE in the start menu and you can scan web applications: New application If you don't...

wetter-trassenheide.de XSS vulnerability

Open Bug Bounty ID: OBB-621095 Description| Value ---|--- Affected Website:| wetter-trassenheide.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...