Cross site scripting

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

CVE-2019-13950

CVE-2019-13950 affects SyGuestBook A5 Version 1.2. The issue is a stored XSS in index.php?c=admin&a=index introduced via a reply to a comment. Root cause described in CNVD as lack of proper validation of client-side data by the WEB application. Impact stated in sources as client-side code executi...

CVE-2019-13949

SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...

CVE-2019-13949

The CVE-2019-13949 entry documents a CSRF vulnerability in SyGuestBook A5 Version 1.2 where there is no CSRF protection. The underlying issue allows an attacker to trigger a request to index.php?c=Administrator&a=update (admin password change) without authentication, enabling unauthorized admin p...

CVE-2019-13948

The CVE-2019-13948 issue affects SyGuestBook A5 Version 1.2, where a stored XSS vulnerability arises from isValidData not properly filtering XSS payloads in include/functions.php. TheExploit vector demonstrated uses an onerror attribute in an IMG tag to inject script, enabling script execution in...

The vulnerability of the FTP server of the microprogrammed IP camera Jooan A5 allows a hacker to gain access to the device with root privileges.

The vulnerability of the FTP server of the microprogrammed IP camera Jooan A5 IP Camera is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker who operates remotely to gain access to the device with root privileges...

Jooan IP Camera A5 FTP Vulnerability

Jooan IP Camera A5 is a network camera product of China Jooan Shenzhen Jooan Technology Company. A security vulnerability exists in the Jooan IP Camera A5 version 2.3.36. A remote attacker can exploit the vulnerability to read or replace core system files used for authentication and take control ...

CVE-2017-16566

On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication such as passwd and shadow. This can be abused to take full root level control of the device...

CVE-2017-16566

On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication such as passwd and shadow. This can be abused to take full root level control of the device...

OpenCimetiere v3.0.0-a5 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: OpenCimetiere v3.0.0-a5 | Blind SQL Injection Date: 06/08/16 Exploit Author: Wad Deek Vendor Homepage: http://www.openmairie.org/ Software Link: http://www.openmairie.org/catalogue/opencimetiere/ Version: 3.0.0-a5 +3.0.0-a5...

Cisco ACE 4710 Device Manager GUI Remote Command Injection Vulnerability (cisco-sa-20160224-ace)

The Cisco Application Control Engine ACE software installed on the remote Cisco ACE 4710 device is an A5 version prior to A53.0. It is, therefore, affected by a remote command injection vulnerability in the device manager GUI due to improper validation of user-supplied input in HTTP POST requests...

Square: HTTP Header revealing server information.

Hi Square, - Vulneravility Class: OWASP A5: Security Misconfiguration - Proof of Concept: nc 74.122.190.83 80 GET / HTTP/1.1 host:1.1.1.1 HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: keep-alive Status: 301 Moved Permanently Location: https://squareup.com/ X-Powered-By:...

Researchers Crack Satellite Phone Ciphers

Researchers at a German university have broken the encryption of the two main standards used to protect calls from satellite phones, giving them the ability to intercept conversations that are meant to be private. The attacks on the GMR-1 and GMR-2 standards are thought to be the first such work...

Absinthe Jailbreak for iPhone 4S Released

Less than three weeks after releasing a new jailbreak for iPhones running iOS 5.01, a team of researchers has now published a similar tool for jailbreaking the iPhone 4S and iPad2. The Absinthe jailbreak tool will allow users to run unsigned code on their devices and load apps from places other...

Researchers Show Method to Decrypt GPRS Traffic

A security researcher known for his work on cracking cryptographic ciphers on mobile networks has found a method that enables him to capture and decrypt data traffic on virtually any GPRS network. The attack, developed by Karsten Nohl, enables him to eavesdrop on traffic within a radius of about...

Four Questions for Bruce Schneier on the GSM Cipher Crack

Math is hard and cryptography is even harder. So in light of the news that another of the ciphers used to secure traffic on 3G GSM networks has been cracked, we turned to mathematician and cryptographer Bruce Schneier to explain the attack and its ramifications. So here are Schneier’s answer to a...