FreePBX Remote Command Execution Vulnerability (CNVD-2016-08542)

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A remote command execution vulnerability exists in the FreePBX 'admin/modules/hotelwakeup/Hotelwakeup.class.php...

WordPress InfiniteWP Admin Panel Authentication Bypass Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authentication bypass vulnerability exists in the WordPress InfiniteWP Admin Panel. Because app/php does n...

The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code

The vulnerability of the Internet Explorer browser is related to errors in its code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely or cause a service failure memory corruption by using a specially crafted web page...

SQL Injection Vulnerability in ID Parameters of Dynamic Easy Network Campus System

Dynamic easy network campus system is based on the actual application needs of customers in the education industry Dynamic easy to provide a complete set of school website application solutions, set "home-school interaction, knowledge sharing, teaching aids," in one, to assist the school website ...

Microsoft Internet Explorer Memory Corruption Vulnerability (CNVD-2016-07594)

Microsoft Internet Explorer is a popular WEB browser. A memory corruption vulnerability exists in Microsoft Internet Explorer that can be exploited by a remote attacker to construct a malicious web page that can be parsed by a user to execute arbitrary code in the context of the application...

Yelp: Clickjacking: X-Frame Header Missing

Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their...

CVE-2016-3351

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."...

CVE-2016-3375

The CVE-2016-3375 entry describes a memory-corruption vulnerability in the Microsoft OLE Automation mechanism and VBScript Scripting Engine used by Internet Explorer. A remote attacker can craft a website to trigger memory corruption, potentially executing arbitrary code in the context of the log...

PHPHolidays CMS 3.00.50 Cross Site Scripting

Document Title: =============== PHPHolidays CMS v3.00.50 - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1948 Release Date: ============= 2016-09-08 Vulnerability Laboratory ID VL-ID:...

UF FE /feform/createprinttemplete. jsp parameters formid injection vulnerability

No description provided by source...

Fortinet FortiWAN Cross-Site Scripting Vulnerability

Fortinet FortiWAN is a WAN link load balancing product developed by Fortinet. A cross-site scripting vulnerability exists in the IP parameter of the /script/statistics/getconn.php page in Fortinet FortiWAN. An attacker could exploit this vulnerability to execute arbitrary web script or HTML...

HP Operations Manager Cross-Site Scripting Vulnerability

HP Operations Manager OM is a set of business-oriented enterprise-class system management software from Hewlett-Packard HP. The software provides system management, application management, event processing, business presentation and other functions. A cross-site scripting vulnerability exists in ...

SQL Injection Vulnerability in UserGUID Parameter of UserDataSync.aspx Page of Nanjing Fargo Streaming Media System

Nanjing Fargo streaming media system is mainly used for applications such as network TV, live event broadcasting, remote education, enterprise roadshow and multimedia public information service, etc. The system integrates computer, network, audio/video and mobile communication and other related...

SQL Injection Vulnerability in Hopping Collaborative Content Management System

HZCMS is a website group content management system based on Java and XML technology. The product suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain database information. The vulnerability URL is:...

Splunk Web Open Redirect Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze machine-generated data, including data generated by all IT systems and infrastructures physical, virtual, and cloud.Splunk Web is one of...

IBM Connections Cross-Site Request Forgery Vulnerability (CNVD-2016-06649)

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site request...

Multiple XSS Cross-Site Scripting Vulnerabilities in UFIDA ISM System

UFIDA ISM system is a new generation of enterprise IT service management products. Multiple XSS cross-site scripting vulnerabilities exist in UFIDA ISM System. It allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking. Th...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2016-06439)

Cisco FirePOWER Management Center is the United States Cisco Cisco company's new generation of firewall management center software. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which arises from the program's failure to adequately filter user-submitted input...

Microsoft Education - Stored Cross Site Web Vulnerability

Document Title: =============== Microsoft Education - Stored Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1897 Release Date: ============= 2016-08-10 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2016-3288

CVE-2016-3288 affects Microsoft Internet Explorer 11. It is a memory corruption vulnerability in IE11 that can be triggered by visiting a crafted webpage, enabling remote code execution. Multiple sources confirm exploitation exists (e.g., exploit-db entry for CVE-2016-3288). The issue is distinct...