Drupal Services module remote code execution vulnerability (CNVD-2017-03557)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A remote code execution vulnerability exists in the Services module of Drupal. ...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CNVD-2017-03859)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists i...

Microsoft SharePoint Server Cross-Site Scripting Vulnerability (CNVD-2017-04008)

Microsoft SharePoint Server is an integrated suite of server capabilities that provides comprehensive content management and enterprise search, accelerates shared business processes and simplifies information sharing across boundaries. A cross-site scripting vulnerability exists in Microsoft...

Multiple cross-site scripting vulnerabilities in Symantec Web Gateway (CNVD-2017-03683)

Symantec Web Gateway is a spam filter that combines anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec USA. Multiple cross-site scripting vulnerabilities exist in Symantec Web Gateway that stem from a failure to adequately validate user input...

Imgur: RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`

Summary The y parameter of /edit/process endpoint with a=crop is vulnerable to command-line argument injection to something that appears to be GraphicsMagick utility probably gm convert. Due to GraphicsMagick's hacker-friendly processing of |-starting filenames supplied to -write option, it leads...

wuhu cross-site scripting vulnerability

Wuhu is a lightweight third-party management system PMS for Gargaj, which is used to help organizational parties with tasks such as collecting entries, managing polls, and communicating information via a large screen. wuhu suffers from a cross-site scripting vulnerability that stems from the...

PYSEC-2017-61

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Entrepreneur B2B Script 2.0.4 - 'id' SQL Injection

Exploit Title: Entrepreneur B2B Script v2.0.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/entrepreneur-b2b-script/ Demo: http://www.readymadeb2bscript.com/demo/entre-monicab2b/ Version: 2.0.4...

Honeywell XL Web II Controller Directory Traversal Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A directory traversal vulnerability exists in Honeywell XL Web II Controller. An unauthenticated user can perform a path traversal attack by accessing a specially crafted URL...

Joomla! Component RealEstateManager 3.9 - SQL Injection

Exploit Title: Joomla! Component RealEstateManager v3.9 - SQL Injection Google Dork: inurl:index.php?option=comrealestatemanager Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy:...

Joomla! Component Directorix Directory Manager 1.1.1 - SQL Injection

Joomla! Component Directorix Directory Manager 1.1.1 - SQL Injection Exploit Title: Joomla! Component Directorix Directory Manager v1.1.1 - SQL Injection Google Dork: inurl:index.php?option=comdirectorix Date: 21.02.2017 Vendor Homepage: http://informafix.fr/ Software Buy:...

Drupal Hotjar Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Hotjar module, which stems from the program failing to properly validate user-supplied input. When an unknowing...

saint-nazaire.brithotel.fr XSS vulnerability

Vulnerable URL: http://saint-nazaire.brithotel.fr/mapframe.php?lat=;...

DEBIAN-CVE-2017-5367

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

CVE-2017-3344

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTT...

Symphony cross-site scripting vulnerability (CNVD-2017-01078)

Symphony CMS is a content management system CMS developed in PHP and MySQL. The system supports search engine optimization, module extension and so on. A cross-site scripting attack vulnerability exists in Symphony CMS, which stems from a failure to properly validate user input. An attacker could...

Drupal OpenLucius Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OpenLucius is one of the work management platforms for social communication, documentation and projects. A cross-site scripting vulnerability exists in the Drupal OpenLucius module. An...

CVE-2016-3411

Cross-site scripting XSS vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bug 103609...

Vulnerabilities Leave iTunes, Apple's App Store Open to Script Injection

Apple is reportedly aware of and is in the middle of fixing a pair of vulnerabilities that exist in iTunes and the App Store. If exploited, researchers claim an attacker could inject malicious script into the application side of the vulnerable module or function. Vulnerability Lab’s Benjamin Kunz...

Huawei Flybox B660 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Document Title: =============== Huawei Flybox B660 - POST SMS CSRF Web Vulnerability Product & Service Introduction: =============================== The Huawei B660 has a web interface for configuration. You can use any web browser you li...