Debian DLA-1236-1 : plexus-utils security update

Charles Duffy discovered that the Commandline class in plexus-utils, a collection of components used by Apache Maven, does not correctly quote the contents of double-quoted strings. An attacker may use this flaw to inject arbitrary shell commands. For Debian 7 'Wheezy', these problems have been...

Daniel Miessler on My Writings about IoT Security

Daniel Miessler criticizes my writings about IoT security: I know it's super cool to scream about how IoT is insecure, how it's dumb to hook up everyday objects like houses and cars and locks to the internet, how bad things can get, and I know it's fun to be invited to talk about how everything i...

Microsoft Windows - 'nt!NtQueryInformationProcess (information class 76_ QueryProcessEnergyValues)' Kernel Stack Memory Disclosure

/ We have discovered that the nt!NtQueryInformationProcess system call invoked with the 76 information class discloses portions of uninitialized kernel stack memory to user-mode clients. The specific information class is handled by an internal nt!PsQueryProcessEnergyValues function. While we don'...

CVE-2018-5253

The AP4FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling...

Thunderwind Movie CMS v3.3.0 SQL Injection Vulnerability in NewsController.class.php Page

Thunderwind Movie CMS is a PHP based THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. Thunderwind Movie CMS v3.3.0 SQL injection vulnerability exists in NewsController.class.php page. Attackers can...

SQL injection vulnerability in the api.class.php page of UQCMS Cloud Business B2B2C Multi-store System

UQCMS cloud business system is a B2B2C e-commerce software with the program using PHP+MYSQL and the template using smarty template. A SQL injection vulnerability exists in the api.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter...

SQL Injection Vulnerability in UQCMS Cloud Business B2B2C Multi-store System ad.class.php Page

UQCMS cloud business system is a B2B2C e-commerce software with the program using PHP+MYSQL and the template using smarty template. A SQL injection vulnerability exists in the ad.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter...

SQL injection vulnerability in the bill.class.php page of UQCMS Cloud Business B2B2C Multi-store System

UQCMS cloud business system is a B2B2C e-commerce software with the program using PHP+MYSQL and the template using smarty template. A SQL injection vulnerability exists in the bill.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filte...

Authentication Bypass

pysaml2 is vulnerable to authenticable bypass. The vulnerability exists as asserts are ignored when python is run with optimization options, -O, -OO, or with the PYTHONOPTIMIZE environment variable. This causes the UsernamePasswordMako class to accept any password for any valid user...

Tuleap 9.6 Second-Order PHP Object Injection Exploit

This Metasploit module exploits a Second-Order PHP Object Injection vulnerability in Tuleap 'Tuleap 9.6 Second-Order PHP Object Injection', 'Description' = %q This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap = 9.6 which could be abused by authenticated users to...

Code execution vulnerability in OpenSNS backend AuthorizeController.class.php page

OpenSNS is a lightweight social user center framework based on OneThink. The system upholds a minimalist design style and focuses on communication. A code execution vulnerability exists in the AuthorizeController.class.php page in the OpenSNS backend. Allow attackers to exploit the vulnerability ...

PHP Scripts Mall Yoga Class Script SQL Injection Vulnerability

PHP Scripts Mall Yoga Class Script is a PHP-based yoga class management script for yoga centers from PHP Scripts Mall India. A SQL injection vulnerability exists in PHP Scripts Mall Yoga Class Script version 1.0. A remote attacker can exploit this vulnerability to inject SQL commands...

CVE-2017-17630

Yoga Class Script 1.0 has SQL Injection via the /list city parameter...

CVE-2017-17630

Yoga Class Script 1.0 has SQL Injection via the /list city parameter...

Sql injection

Yoga Class Script 1.0 has SQL Injection via the /list city parameter...

CVE-2017-17630

Yoga Class Script 1.0 has SQL Injection via the /list city parameter...

CVE-2017-17630

CVE-2017-17630 affects Yoga Class Script 1.0 (and PHP Scripts Mall Yoga Class Script 1.0) with an SQL injection vulnerability in the /list city parameter. The root cause is improper handling of the city parameter, allowing an attacker to inject SQL commands. CVSS data (NVD) indicates a high to cr...

Debian DLA-1205-1 : simplesamlphp security update

The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information disclosure. CVE-2017-12867 The SimpleSAMLAuthTimeLimitedToken class allows attackers with access to a secret token to extend its validity period by...

SQL injection vulnerability in category.class.php page of UQCMS Cloud B2B2C multi-store system

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the category.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the program not adequately filtering...

SQL Injection Vulnerability in UQCMS Cloud Business B2B2C Multi-store System member.class.php Page

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the member.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the program not adequately filtering user-suppli...