CVE-2018-1284

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs xpath/xpathstring/xpathboolean/xpathnumber/xpathdouble/xpathfloat/xpathlong/xpathint/xpathshort to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user usually hive if...

CVE-2018-1284

CVE-2018-1284 affects Apache Hive versions 0.6.0 through 2.3.2. A malicious user can leverage any of the xpath UDFs (xpath, xpath_string, xpath_boolean, xpath_number, xpath_double, xpath_float, xpath_long, xpath_int, xpath_short) to expose the content of a local file on the machine running HiveSe...

Directory Traversal Through XML External Entity (XXE)

wiremock is vulnerable to directory traversal through XML External Entity XXE attacks. The application does not disable DTD during XPATH Evaluation, allowing a malicious user to traverse the directory...

20minutos.es Cross Site Scripting vulnerability

Security Researcher SabioHat Helped patch 103 vulnerabilities Received 2 Coordinated Disclosure badges Received 5 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting 20minutos.es website and its users. Following coordinated a...

CVE-2016-6272

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate...

Sql injection

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate...

CVE-2016-6272

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate...

CVE-2016-6272

CVE-2016-6272 concerns Epic MyChart, where an XPath injection vulnerability exists in the help.asp topic parameter. The underlying issue allows remote attackers to access contents of an XML document containing static display strings (e.g., field labels). The vulnerability is reported as pre-authe...

whiteint.com.au XSS vulnerability

Open Bug Bounty ID: OBB-563303 Description| Value ---|--- Affected Website:| whiteint.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PHIMS - Hospital Management Information System - Password SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PHIMS - Hospital Management Information System - 'Password' SQL Injection Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage: https://codecanyon.net/item/phims/14974225?srank=1566 Version: All version...

Joomla! Gallery WD 1.3.6 SQL Injection

Exploit Title: Joomla! Component Gallery WD 1.3.6 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: https://web-dorado.com/ Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd/ Software Download:...

Joomla! Google Map Landkarten 4.2.3 SQL Injection

Exploit Title: Joomla! Component Google Map Landkarten cmslitedoct' http://localhost/Joomla375/index.php?option=comgmap&view=gmmarkers&tm...

PSNews Website 1.0.0 - Keywords SQL Injection

PSNews Website 1.0.0 - Keywords SQL Injection Exploit Title: PSNews Website Same Backend with Mobile Apps 1.0.0 - 'Keywords' SQL Injection Dork: N/A Date: 2018-02-16 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

Joomla! Component Saxum Picker 3.2.10 - SQL Injection

Exploit Title: Joomla! Component Saxum Picker 3.2.10 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.saxum2003.hu/ Software Link: https://extensions.joomla.org/extensions/extension/sports-a-games/games/saxumpicker/ Software Download:...

PHIMS - Hospital Management Information System - 'Password' SQL Injection

Exploit Title: PHIMS - Hospital Management Information System - 'Password' SQL Injection Dork: N/A Date: 2018-02-16 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/phims/14974225?srank=1566 Version: All version Category: Webapps...

[SECURITY] Fedora 26 Update: libxml2-2.9.7-1.fc26

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

SOA School Management - access_login SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SOA - School Management Software with Integrated Parents/Students Portal & Mobile App - 'accesslogin' SQL Injection Dork: N/A Date: 2018-02-14 Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage:...

[SECURITY] Fedora 27 Update: libxml2-2.9.7-1.fc27

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Debian DSA-4086-1 : libxml2 - security update

Nick Wellnhofer discovered that certain function calls inside XPath predicates can lead to use-after-free and double-free errors when executed by libxml2's XPath engine via an XSLT transformation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

[SECURITY] [DSA 4086-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4086-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 13, 2018 https://www.debian.org/security/faq -...