Hospital Management System 4.0 - Authentication Bypass

Hospital Management System 4.0 - Authentication Bypass Exploit Title: Hospital Management System 4.0 - Authentication Bypass Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/hospital-management-system-in-php/ Version: v4....

Shopping Portal ProVersion 3.0 - Authentication Bypass

Exploit Title: Shopping Portal ProVersion 3.0 - Authentication Bypass Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/shopping-portal-free-download/ Version: v4.0 Category: Webapps Tested on: Xampp for Windows Descriptio...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2020-03554)

Bolt CMS is a PHP-based open source content management system for the Bolt community. A cross-site scripting vulnerability exists in Bolt CMS version 3.7.0. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerabili...

Cybersecurity: What to Expect in the Year Ahead

So, what lies ahead? Let’s turn over our virtual coffee cups and read the coffee grounds. .... report also shows that as many as 60% of all hacker attacks are using a compromised web application to gain unauthorized access or steal data. The post Cybersecurity: What to Expect in the Year Ahead...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2020-03115)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

ZenPhoto cross-site scripting vulnerability (CNVD-2020-03822)

ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A cross-site scripting vulnerability exists in the 'sanitizestring' function in versions of Zenphoto prior to 1.4.9, which stems from a lack of proper...

Netis DL4323 Cross-Site Request Forgery Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site request forgery vulnerability exists in the NETCORE Netis DL4323. The vulnerability arises from a WEB application that does not adequately verify that a request is from a trusted user. An attacker could exploit this...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01650)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

D-Link DIR-601 Cross-Site Request Forgery Vulnerability

The D-Link DIR-601 B1 is a wireless router from AUO D-Link of Taiwan, China. A cross-site request forgery vulnerability exists in the D-Link DIR-601 B1 version 2.00NA. The vulnerability stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacker...

CVE-2019-19983

The CVE-2019-19983 vulnerability affects the WordPress plugin Fast Velocity Minify (before 2.7.7). The issue arises from the plugin exposing the full web root path of the WordPress installation, enabling an attacker to discover sensitive filesystem information when FVM Debug Mode is enabled and a...

Xiuno BBS code issue vulnerability

Xiuno BBS is an open source forum program based on PHP and MySQL. A code issue vulnerability exists in Xiuno BBS version 4.0. The vulnerability stems from an improperly designed or implemented problem in the code development process of a web system or product. No detailed vulnerability details ar...

F5 BIG-IP ASM Resource Management Error Vulnerability

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A security vulnerability exists in the F5 BIG-IP ASM. A remote attacker could exploit the...

Dell EMC Unisphere for PowerMax Cross-Site Scripting Vulnerability

Dell EMC Unisphere for PowerMax is a suite of graphical management tools for PowerMax storage arrays from Dell, Inc. A cross-site scripting vulnerability exists in Dell EMC Unisphere for PowerMax. The vulnerability stems from a lack of proper validation of client data by the WEB application. An...

Trend Micro Apex One Cross-Site Scripting Vulnerability

Trend Micro Apex One is a suite of endpoint security protection software from Trend Micro that provides automated threat detection and response capabilities. A cross-site scripting vulnerability exists in the product console in Trend Micro Apex One 2019. The vulnerability stems from a lack of...

IBM Financial Transaction Manager for SWIFT Services Cross-Site Request Forgery Vulnerability

IBM Financial Transaction Manager for SWIFT Services is a financial transaction manager product from IBM, USA. The product is primarily used for monitoring, tracking and reporting financial payments and transactions. A cross-site request forgery vulnerability exists in IBM Financial Transaction...

Top 5 Essential Features of Effective Cybersecurity for Web Apps

There's hardly any business nowadays that don't use computers and connect to the Internet. Companies maintain an online presence through their official websites, blogs, and social media pages. People use online services to conduct day to day activities like banking. And of course, there are many...

MTN Group: SQL Injection on cookie parameter

Summary: Hello team. It seams one of the parameters in the cookies is vulnerable to SQL injection. Below requests has the lang parameter in cookies. If you inject one quote mark like '. You get SQL error with the syntax. By injecting a second you have the error removed. I did not attempt to...

Cross site scripting

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module MAL. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted...

Cross site request forgery (csrf)

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. Also, anonymous access can be achieved in applications that do not have a user login area...

Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by vulnerabilities CVE-2016-0359 and CVE-2016-2923.

Summary IBM i Integrated Web Application Server version 8.5 is affected by the following vulnerabilities CVE-2016-0359 and CVE-2016-2923. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker...