CVE-2017-18260: Improper Neutralization of Special Elements used in an SQL Command

Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php viewstatut parameter or comm/propal/list.php propalstatut parameter, aka searchstatut parameter...

Muslim Matrimonial Script Cross-Site Scripting Vulnerability (CNVD-2018-01240)

Muslim Matrimonial Script is a community matrimonial script for matrimonial websites by PHP Scripts Mall. A cross-site scripting vulnerability exists in PHP Scripts Mall Muslim Matrimonial Script. The vulnerability can be exploited to conduct cross-site scripting attacks via the admin/casteview.p...

CVE-2017-17897

SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2017-17897: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2018-01641)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in the comm/multiprix.php...

PT-2017-15082 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the id parameter in the comm/multiprix.php file. Recommendations: For version 6.0.4, consider...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

SQL Injection

dolibarr is susceptible to multiple SQL injection vulnerabilities. The vulnerabilities exist because it does not filter the user-supplied data before using it in an SQL query, allowing the attackers to inject malicious SQL through the 1 contactid parameter in an addcontact action, 2 ligne paramet...

magente.com XSS vulnerability

Vulnerable URL: http://www.magente.com/Ecomm/Login.asp?come=1"...

CVE-2015-8255

AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/localdel.cgi...

nje-pass-brute NSE Script

z/OS JES Network Job Entry NJE 'I record' password brute forcer. After successfully negotiating an OPEN connection request, NJE requires sending, what IBM calls, an 'I record'. This initialization record may sometimes require a password. This script, provided with a valid OHOST/RHOST for the NJE...

fox-info NSE Script

Tridium Niagara Fox is a protocol used within Building Automation Systems. Based off Billy Rios and Terry McCorkle's work this Nmap NSE will collect information from A Tridium Niagara system. Example Usage nmap --script fox-info.nse -p 1911 Script Output 1911/tcp open Niagara Fox | fox-info: |...

Code injection

Cisco Unified Communications Manager aka CallManager 9.12.10000.28, 10.52.10000.5, 10.52.12901.1, and 11.01.10000.10; Unified Communications Manager IM & Presence Service 10.52; Unified Contact Center Express 11.01; and Unity Connection 10.52 store a cleartext encryption key, which allows local...

imap-ntlm-info NSE Script

This script enumerates information from remote IMAP services with NTLM authentication enabled. Sending an IMAP NTLM authentication request with null credentials will cause the remote service to respond with a NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version...

The vulnerability of the Flash Player and Adobe Integrated Runtime software allows a perpetrator to execute arbitrary code.

The vulnerability of the Flash Player and Adobe Integrated Runtime programs arises due to an overflow in the dynamic memory buffer. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted MP3 file with a COMM tag...

CVE-2015-8446

A heap-based buffer overflow exists in Adobe Flash Player (before 18.0.0.268, 19.x, and 20.x before 20.0.0.228), Adobe AIR (before 20.0.0.204), and Adobe AIR SDK (before 20.0.0.204). The vulnerability is caused by the mishandling of COMM tags during memory allocation in MP3 files , which can allo...

flash-plugin: multiple code execution issues fixed in APSB15-32

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute...

CVE-2015-6463

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a longtag XML schema containing an external entity declaration in...

Xxe

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a longtag XML schema containing an external entity declaration in...

CVE-2015-6463

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via a longtag XML schema containing an external entity declaration in...