Multiple Chiyu Products Cross-Site Scripting Vulnerabilities

Chiyu BF-630, BF-630W and BF-660C are all products of Chiyu.BF-630 and BF-630W are networked fingerprint access controllers.BF-660C is a networked fingerprint access control and time and attendance machine. A cross-site scripting vulnerability exists in multiple Chiyu products. A remote attacker...

Acunetix Web Vulnerability Scanner 9.5 - Crash (PoC)

Acunetix Web Vulnerability Scanner 9.5 - Crash PoC !/usr/bin/env python Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept Website : https://www.acunetix.com Tested : win 7 / win 8.1 / win vista Author : Hadi Zomorodi Monavar Email : [email protected] 1 . run python code...

Drupal OSF for Drupal module cross-site request forgery vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. A cross-site...

Apple iTunes & AppStore - Persistent Invoice Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Invoice Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1512 Apple Security ID: 623920272 Video: http://www.vulnerability-lab.com/getcontent.php?id=1517 Vulnerability...

ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability

Document Title: =============== ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1555 Release Date: ============= 2015-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 1555...

Moodle 'user/lib.php' Cross-Site Scripting Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in Moodle that stems from the program's...

Juniper Networks Junos J-Web Cross-Site Scripting Vulnerability

Juniper Networks Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in Juniper Networks Junos, which arises from the program's...

CVE-2015-2404

Microsoft Internet Explorer (IE) versions 6–11 are affected by a memory corruption vulnerability exploitable via a crafted web page, potentially allowing remote code execution or memory corruption-driven denial of service. The CVE-2015-2404 entry is among a set addressed by MS15-065 (Cumulative S...

CVE-2015-2411

Microsoft Internet Explorer 10 and 11 are affected by memory corruption vulnerabilities described under CVE-2015-2411 (and related CVEs). The publicly documented details indicate that a crafted website can trigger remote code execution or a denial of service via memory corruption in IE’s handling...

Simple Oekaki BBS vulnerability where arbitrary files may be deleted

Overview Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

IBM Jazz Team Server Cross-Site Scripting Vulnerability

IBM Jazz Team Server is a suite of project management tools for use in IBM Rational Jazz Team Collaboration Platform from IBM in the United States. A cross-site scripting vulnerability exists in IBM Jazz Team Server that stems from the program's failure to adequately filter user-submitted input...

Chamilo LMS HTML Injection Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from an HTML injection vulnerability that stems fr...

Chamilo LMS Cross-Site Scripting Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from a cross-site scripting vulnerability that ste...

Untangle NGFW HTML Injection Vulnerability

Untangle NGFW is a set of firewall platforms from the US company Untangle. The platform supports web filtering, virus blocking and spam blocking. An HTML injection vulnerability exists in Untangle NGFW. When a user browses an affected website, their browser will execute arbitrary HTML or script...

barnesandnoble.com XSS vulnerability

Vulnerable URL: http://www.barnesandnoble.com/mobile/noresults/%27%22%3Ev0raz%3Cbody/onpageshow=%22%26%2397lert%28'XSSPOSED'%29%22%3E Details: Description| Value ---|--- Patched:| Yes, at 24.01.2016 Latest check for patch:| 24.01.2016 12:27 GMT Vulnerability type:| XSS Vulnerability status:|...

shopNC B2B版SQL注入一枚

简要描述： 无需登录直接出数据 详细说明： 为了节省审核时间，先来五个实例 http://www.xiu365.cn/microshop/index.php?act=personal&classid0=exp&classid1=1%20or%20updatexml1,concat0x5c,user,1%23 http://www.xiu365.cn/microshop/index.php?act=personal&classid0=exp&classid1=1%20or%20updatexml1,concat0x5c,user,1%23...

Ebay Inc Magento Bug Bounty #16 - CSRF Web Vulnerability

Document Title: =============== Ebay Inc Magento Bug Bounty 16 - CSRF Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1472 Ebay Inc Security ID: EIBBP-31808 Release Date: ============= 2015-07-02 Vulnerability Laboratory ID VL-ID:...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

LimeSurvey SQL Injection Vulnerability (CNVD-2015-04153)

LimeSurvey formerly known as PHPSurveyor is a set of open source online survey program developed by the LimeSurvey team, which supports survey program development, questionnaire distribution and data collection. A SQL injection vulnerability exists in the insert function in the...

Synology DiskStation Manager Cross-Site Scripting Vulnerability

Synology DiskStation Manager is a web-based intuitive operating system that helps users manage files, photos, music, videos, and other important content stored on Synology DiskStation and RackStation. A cross-site scripting vulnerability exists in Synology DiskStation Manager, which allows remote...