WDTV Live SMP 2.03.20 - Remote Password Reset

WDTV Live SMP Remote Password Reset Vulnerability Date: Jul 14 2017 Author: sw1tch Demo: https://www.sw1tch.net/2017/07/12/wdtv-live-smb-exploit/ Description: A simple remotely exploitable web application vulnerability for the WDTV Live Streaming Media Player and possibly other WDTV systems...

SQL Injection Vulnerability in Hanchao B2B2C Multi-User Mall System

Hanchao B2B2C multi-user mall system is a PHP multi-user mall website system source code developed in PHP + MySQL. Hanchao B2B2C Multi-User Mall System v2.1.3 version of the Orderid parameter, delorder method SQL injection vulnerability exists due to the system fails to effectively filter the...

CVE-2017-8585

Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability...

EMC Data Protection Advisor Multiple Vulnerabilities (Jul 2017)

EMC Data Protection Advisor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SECURITY] Fedora 25 Update: jetty-9.4.6-1.v20170531.fc25

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

html-social-share-buttons

It is an HTML/CSS/JavaScript library for adding social media sha...

nastandgreeley.harpweek.com XSS vulnerability

Vulnerable URL: http://nastandgreeley.harpweek.com/SubPages/cartoon-1872-mediumA.asp?UniqueID=21=1"...

Barracuda WAF V360 Firmware 8.0.1.014 Credential Disclosure Vulnerability

Firmware reversing of the Barracuda Web Application Firewall uncovered development artifacts that should have been removed on the production images. Once the encryption scheme was broken, many QA and development tools were discovered on the affected partitions. Some of these contained sensitive...

Barracuda WAF V360 Firmware 8.0.1.014 Early Boot Root Shell Exploit

Firmware reversing of the Barracuda Web Application Firewall uncovered debug features that should have been removed on the production images. Appending a debugging statement onto a grub configuration line leads to an early boot root shell. Firmware version 8.0.1.014 is affected. Title: Barracuda...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak Vulnerability

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected. Title: Barracuda WAF Management Application Username and Session ID Leak 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak

KL-001-2017-013 : Barracuda WAF Management Application Username and Session ID Leak Title: Barracuda WAF Management Application Username and Session ID Leak Advisory ID: KL-001-2017-013 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-013.tx...

Barracuda WAF Grub Password Complexity

Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded Linux CWE Classification: CWE-259: Use of Hard-coded Password Impact: Privileged Access Attack vector: Password Cracking 2. Vulnerability...

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based application interface of the Cisco Identity Services Engine ISE portal could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to...

thrivenaturals.com XSS vulnerability

Vulnerable URL: https://thrivenaturals.com/secure/form-prob.php?themecode=PROBname=1"...

pixiecrystals.com XSS vulnerability

Vulnerable URL: http://www.pixiecrystals.com/summary.php?summaryid=1"...

archive.kubatana.net XSS vulnerability

Vulnerable URL: http://archive.kubatana.net/html/archive/resour/040906emb.asp?sector=1"...

butterfieldandvallis.com XSS vulnerability

Vulnerable URL: http://www.butterfieldandvallis.com/recipes/fsindex.asp?meal=1"...

demoweb.cheleo.it XSS vulnerability

Vulnerable URL: http://demoweb.cheleo.it/takeoff/com/php/menu.php?mess=1"...

CVE-2017-6703

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user's session. More Information: CSCvc90346. Known Affected Releases: 12.1...

CVE-2017-6704

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...