CVE-2016-9064

CVE-2016-9064 affects Mozilla Firefox and Firefox ESR due to inadequate verification in the addon update mechanism: the add-on ID in the signed package could mismatch the target add-on, enabling a MITM attacker to substitute a malicious signed update. Documents indicate this affects Firefox ESR &...

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

The vulnerability of the LsaAddAccountRights function in the 7-Zip file archiver allows a hacker to circumvent existing access restrictions.

The vulnerability of the LsaAddAccountRights function in the 7-Zip file archiver is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to circumvent existing access restrictions by using the SeLockMemoryPrivilege privilege...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15880)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Add Storage" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15869)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the addnewcontainer method in Quest DR Series disk backup software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15889)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Add Email Alert" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute system commands...

GreenCMS 2.3.0603 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin Exploit Author: xichao Vendor Homepage: https://github.com/GreenCMS/GreenCMS Software Link: https://github.com/GreenCMS/GreenCMS Version: v2.3.0603 CVE : CVE-2018-11671 An issue wa...

Remote code execution

aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binar...

EasyService Billing 1.0 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications history.pushState'', '', '/' form action="http://test.com/EasyServiceBilling/quotation-new3-new2.php?add=true&id=139" method="P...

EasyService Billing 1.0 - Cross-Site Request Forgery

EasyService Billing 1.0 - Cross-Site Request Forgery history.pushState'', '', '/' input typ...

EasyService Billing 1.0 - Cross-Site Request Forgery

history.pushState'', '', '/'...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

Cross site request forgery (csrf)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

CVE-2018-11445: EasyService Billing 1.0 has a CSRF vulnerability in the User Add/System Settings page (system-settings-user-new2.php) that allows a user to be added with the Admin role. Exploitation is evidenced by multiple connected records (Exploit-DB entry and CNVD/CVE mirrors) describing a CS...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

ManageEngine Recovery Manager Plus 5.3 Cross Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GAREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...