SQL injection vulnerability of menuqx[1][6] parameter on roles.control.mydecms.php page of Xiancheng website builder system

Xiancheng building system is a set of PHP + mysql architecture with free open source article management system program. Xiancheng website builder system role.control.mydecms.php page menuqx16 parameter SQL injection vulnerability. Due to the system failing to effectively filter user-submitted dat...

SKEW & CORNERS PHOTO EDITOR - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application SKEW & CORNERS PHOTO EDITOR published at the 'play' market has multiple vulnerabilities...

WDTV Live SMP 2.03.20 - Remote Password Reset

WDTV Live SMP Remote Password Reset Vulnerability Date: Jul 14 2017 Author: sw1tch Demo: https://www.sw1tch.net/2017/07/12/wdtv-live-smb-exploit/ Description: A simple remotely exploitable web application vulnerability for the WDTV Live Streaming Media Player and possibly other WDTV systems...

CVE-2017-2820

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To...

CVE-2017-2820

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To...

niso.org XSS vulnerability

Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

ZZCMS version 8.1 /admin/ad_user_modify.php exists any file delete

ZZCMS is a professional web service provider. An arbitrary file deletion vulnerability exists in ZZCMS version 8.1 /admin/adusermodify.php, which can be exploited by an attacker to delete arbitrary files...

About User Enumeration

User enumeration is when a malicious actor can use brute-force to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication. Two of the most common areas where user...

[ASA-201706-13] tor: denial of service

Arch Linux Security Advisory ASA-201706-13 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-0375 CVE-2017-0376 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-296 Summary ======= The package tor before...

Juniper Networks NorthStar Controller Application Denial of Service Vulnerability

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A denial of service vulnerability exists in Juniper Networks NorthStar...

CVE-2017-2101

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors...

ImagePro Lazygirls Clone Script - SQL Injection

ImagePro Lazygirls Clone Script - SQL Injection Exploit Title: ImagePro Lazygirls Clone Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://bimedia.info/ Software: http://bimedia.info/8-2/ Demo: http://imagepro.clonedemo.com/ Version: N/A Tested on: Win7 x64, Kali Lin...

SQL Injection

Due to the requirement for dynamic content of today's web applications, many rely on a database backend to store data that will be called upon and processed by the web application or other programs. Web applications retrieve data from the database by using Structured Query Language SQL queries. T...

Magenta SmartHome - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Magenta SmartHome published at the 'play' market has multiple vulnerabilities...

EasyCom For PHP Denial of Service Vulnerability

Easycom is a suite of application solutions. A denial of service vulnerability exists in EasyCom For PHP. It allows attackers to exploit the vulnerability to launch denial of service attacks...

CVE-2016-8350

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

MS15-101: Description of the security update for the .NET Framework 4.5, 4.5.1, and 4.5.2 on Windows 8, Windows RT, and Windows Server 2012: September 8, 2015

MS15-101: Description of the security update for the .NET Framework 4.5, 4.5.1, and 4.5.2 on Windows 8, Windows RT, and Windows Server 2012: September 8, 2015 View products that this article applies to. Summary This update resolves vulnerabilities in the Microsoft .NET Framework that could allow...

Arbitrary File Read Vulnerability in yxcms Version 1.3.9

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. An arbitrary file read vulnerability exists in yxcms version 1.3.9. An attacker can exploit the vulnerability to obtain sensitive system information...

Apache ActiveMQ 5.11.1 / 5.13.2 Directory Traversal / Command Execution

I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw in the fileserver upload/download functionality. I have only been able to reproduce this on Windows, i.e. where "" is a path delimiter. An attacker could use this flaw to upload...