Oracle MySQL for Microsoft Windows FILE Privilege Abuse

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

Eleanor CMS Open Redirect

URL Open Redirect on Eleanor CMS Risk: Low CWE number: CWE-601 Vendor: eleanor-cms.ru Version: All Date: 11/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Linux Ubuntu 14.04 ; Mozilla Firefox 33.0 Vulnerable File: go.php Exploit: +...

Fedora 20 : claws-mail-3.11.1-2.fc20 / claws-mail-plugins-3.11.1-1.fc20 / libetpan-1.6-1.fc20 (2014-14234) (POODLE)

SSLv3 server connections are now disabled by default, in response to the POODLE vulnerability, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014- 3566. - Several PGP/Core plugin improvements - A new version of the RSSyl plugin, completely redesigned and rewritten. - The results of TAB...

all-nettools.com XSS vulnerability

Open Bug Bounty ID: OBB-52243 Description| Value ---|--- Affected Website:| all-nettools.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

all-nettools.com XSS vulnerability

Open Bug Bounty ID: OBB-52242 Description| Value ---|--- Affected Website:| all-nettools.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2014-7488

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7488

The CVE-2014-7488 entry concerns the Android app Vineyard All In (com.wVineyardAllIn) 0.1, which fails to validate SSL X.509 certificates, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. The connected NVD/NIST entry confirms the sam...

CVE-2014-7488

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

all-cs.net.ru Open Redirect vulnerability

Open Bug Bounty ID: OBB-51324 Description| Value ---|--- Affected Website:| all-cs.net.ru Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerabl...

CVE-2014-6932

The All Navalny aka com.all.navalny application 1.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The All Navalny aka com.all.navalny application 1.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6932

CVE-2014-6932 affects the Android All Navalny app (1.10). The vulnerability is due to the app not verifying X.509 certificates in SSL/TLS, allowing MITM attackers to spoof servers and exfiltrate sensitive information via crafted certificates. Root cause: missing server cert verification during SS...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

Sql injection

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242

All In One WP Security & Firewall (WordPress) has SQL injection vulnerabilities fixed in version 3.8.3 and earlier analyzed in CVE-2014-6242. HTB reports two SQLi flaws affecting all versions before 3.8.3, exploitable via the orderby and order parameters to wp-admin/admin.php (aiowpsec page). Exp...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6742

The CVE-2014-6742 entry concerns the Android app “All around Cyprus” (com.cyprus.newspapers), version 2.11, which fails to verify X.509 certificates when connecting to SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and access sensitive information via crafted ce...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without...