Igreks MilkyStep Light and Professional Access Restriction Bypass Vulnerability

Igreks MilkyStep is a CGI for pushing magazines through the email system. A security vulnerability in the user-information management feature of Igreks MilkyStep Light and Professional allows remote attackers to bypass access restrictions and modify administrator credentials...

WordPress Booking Calendar Contact Form Plugin 1.0.2 /dex_bccf.php SQL注入漏洞

/dexbccf.phpfunction dexbccfcaculateprice$startday, $enddate, $calendar, $defaultprice ... //$calendar is not sanitized in sql query $codes = $wpdb-getresults 'SELECT FROM '.$wpdb-prefix.DEXBCCFSEASONPRICESTABLENAMENOPREFIX.' WHERE calid='.$calendar; $mode =...

TP-LINK Local File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unauthenticated Local File Disclosure product: Multiple TP-LINK products see Vulnerable / tested versions vulnerable version: Multiple see Vulnerable / tested versions...

Microsoft windows kernel mode driver kernel information disclosure vulnerability (CNVD-2015-01617)

Microsoft Windows is a popular operating system. A security vulnerability exists in the Microsoft windows kernel mode driver due to the program not properly verifying the calling thread token. The vulnerability allows an attacker to obtain administrator authentication credentials, which can be us...

CVE-2014-9579

VDG Security SENSE formerly DIVA 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files...

Information disclosure

VDG Security SENSE formerly DIVA 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files...

CVE-2014-9579

CVE-2014-9579 affects VDG Security SENSE (formerly DIVA) 2.3.13. The vulnerability is an information disclosure where administrator credentials are stored in cleartext and can be obtained by reading the plugin configuration files. The issue stems from storing sensitive credentials in an insecure ...

CVE-2014-9579

VDG Security SENSE formerly DIVA 2.3.13 stores administrator credentials in cleartext, which allows attackers to obtain sensitive information by reading the plugin configuration files...

Multiple Cross-Site Request Forgery Vulnerabilities in Smoothwall Express

Smoothwall Express is a set of routing and firewall software for Linux-based systems. The software provides routing, firewall, NAT, VPN, IDS, dynamic DNS, internal and external network access control, network traffic control and monitoring, as well as logging and other functions. Smoothwall Expre...

CVE-2014-8896

The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modi...

CVE-2014-8896

The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modi...

Cisco Unified Communications Domain Manager Blind Command Injection Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager Application Software version 8 could allow an authenticated, remote attacker to inject commands that can be executed by the underlying operating system with the privileges of the web server process. The...

Iwebmall 最新版SQL注入第四枚

简要描述： Iwebmall 最新版SQL注入第四枚 详细说明： 看到wooyun上有人提了几个iweb的漏洞（ WooYun: iwebmall商城程序sql注入 ），我来捡捡漏儿吧，希望不要重复。 先把注入点拿出来：www.xxx.com/do.php?act=usershopfavoritedel ，POST的内容中有个参数favoriteshop，存在注入。 /action/user/shopfavoritedel.action.php 无关代码 //数据库操作 dbtarget'w',$dbServs; $dbo=new dbex; //定义文件表 $tuserfavorite...

BMC Track-It! Web Account Credential Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of password resets. The issue lies in the ability to register an account...

CVE-2014-9303: Exposure of Sensitive Information to an Unauthorized Actor

EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator username and password via a URL starting with an ASCII character o through z or A through D, different vectors than CVE-2014-8868...

ManageEngine EventLog Analyzer agentHandler Information Disclosure (CVE-2014-6038)

An information disclosure vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to a failure to restrict access to confidential data and an input validation error in the agentHandler servlet. A remote unauthenticated attacker can exploit the vulnerability to disclose...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)

ManageEngine EventLog Analyzer - Multiple Vulnerabilities 2 Multiple vulnerabilities in ManageEngine EventLog Analyzer Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 05/11/2014 / Last...

BMC Track-It! - Multiple Vulnerabilities

No description provided by source. Multiple critical vulnerabilities in BMC Track-It! Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= The application exposes several .NET remoting services o...

(0Day) F5 Data Manager discoverFilerBasicInfo.jsft filerName SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of F5 Data Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the discoverFilerBasicInfo.jsft page. An attacker is able to inject SQL through the...

Netgear WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability Date: 7-5-14 Exploit Author: c1ph04 Vendor Homepage: http://www.netgear.com/ Version...