CVE-2017-6571

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/view-campaign.php with the GET Parameter: id...

CVE-2017-6573

A concrete SQL injection in the WordPress Mail Masta plugin (version 1.0) affecting the file ./inc/lists/edit-list.php via the GET parameter id. Exploitation appears to require WordPress admin access and could allow arbitrary SQL execution, with multiple external sources confirming the vulnerabil...

CVE-2017-6572

A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/lists/addmember.php with the GET Parameter: filterlist...

PHPCMS '/phpcms/modules/member/index.php' file upload vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. A file upload vulnerability exists in PHPCMS...

CVE-2017-6342

An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically lo...

Linux kernel elevation of privilege vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the dccprcvstateprocess function in the net/dccp/input.c file in Linux kernel version 4.9.11 and earlier, due to the program failing to...

Netgear DGN2200 Authenticated Remote Command Execution

Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 NON-ADMIN AUTHENTICATED RCE Date: 2017-02-18 Exploit Author: SivertPL Vendor Homepage: http://netgear.com/ Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20NA.zip...

Riverbed RiOS Insecure Cryptographic Storage

Riverbed RiOS insecure cryptographic storage CVE-2017-5670 Description Riverbed Steelhead hardware appliances are used to optimize and accelerate network traffic. There can be implemented as TLS endpoints, so they have a secure vault aimed to store private TLS certificates for servers. The secure...

CVE-2017-5154

The CVE-2017-5154 issue affects Advantech WebAccess 8.1, where an SQL injection vulnerability exists in updateTemplate.aspx. The underlying flaw is insufficient input validation, enabling an attacker to craft inputs that could grant administrative access to the application and its data files. Pub...

bpms: stored XSS in dashbuilder

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via dashbuilder. Remote, authenticated attackers that have privileges to access dashbuilder usually admins can store scripts in several editable fields, which are not properly sanitized before showing to other users, including other admi...

CVE-2017-5600

The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account...

Tiki Wiki CMS Groupware < 12.11, 13.x < 15.4 Local File Inclusion Vulnerability

Tiki Wiki CMS Groupware is prone to a local file inclusion vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Plugin Slider Templatic Tevolution Arbitrary File Upload Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WordPress plugin Slider Templatic Tevolution has an arbitrary file upload vulnerability that can be exploited by...

b2evolution 6.8.2 - Arbitrary File Upload

Exploit Title: b2evolution6.8.2stable – Upload Date: 29/12/2016 Exploit Author: Li Fei Vendor Homepage: http://b2evolution.net/ Software Link: http://b2evolution.net/downloads/6-8-2-stable?download=6407 Version: 6.8.2 Tested on: win7 64bit No need admin access for upload files and we can upload a...

PHP FormMail Generator Security Bypass Vulnerability

PHP FormMail Generator is a suite of PHP applications for generating standard web forms for inclusion in PHP or WordPress websites. A security bypass vulnerability exists in PHP FormMail Generator. A remote attacker can use this vulnerability to bypass authentication and gain administrator access...

CVE-2016-3028

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access...

CVE-2016-2988

IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware aka Spectrum Protect for Virtual Environments 6.4.x before 6.4.3.4 and 7.1.x before 7.1.6 allows remote authenticated users to bypass a TSM credential requirement and obtain administrative access by leveraging multiple...

CVE-2016-2988

IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware aka Spectrum Protect for Virtual Environments 6.4.x before 6.4.3.4 and 7.1.x before 7.1.6 allows remote authenticated users to bypass a TSM credential requirement and obtain administrative access by leveraging multiple...

Code injection

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access...

CVE-2016-3028

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access...