Fedora 26 : mysql-mmm (2018-92f04c6b61)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

Fedora 27 : mysql-mmm (2018-e31f52c5ee)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

The vulnerability of the “add repo” component in the Cobbler network installation server allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the “add repo” component in the Cobbler network installation server is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges...

WordPress Polls 1.2.4 Plugin - SQL Injection (PoC) Exploit

Exploit for php platform in category web applications Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Vulnerable version:Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip //////////////////////// /// Overview: //////////////////////// WordPress...

Zomato: Zomato.com Reflected Cross Site Scripting

zomato.com/php/liveSuggest.php takes various field input to show customized out put for the users. The data entered to entityid field is not santized or html encoded which allows user to add payloads via this parameter which will be reflected to user. Steps to reproduce : Please click on below li...

WordPress Qiniu Cloudtuchuang 1.8 Cross Site Scripting

Title: WordPress Qiniu Cloudtuchuang a,caoa3/4ao 1.8 Cross Site Scripting File: Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Qiniu Cloudtuchuang a,caoa3/4ao 1.8 Qiniu Cloudtuchuang a,caoa3/4ao is prone to a stored cross-site scripting vulnerability because it fails to...

WordPress Super Simple Custom CSS 1.2 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Super Simple Custom CSS 1.2 Super Simple Custom CSS is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress Affiliate Ads For Clickbank Products 1.3 XSS Vulnerability

WordPress Affiliate Ads for Clickbank Products plugin version 1.3 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable Affiliate Ads for Clickbank Products Plugin 1.3 Affiliate Ads for Clickbank Products Plugin is prone to a stored cross-site scripting vulnerabilit...

WordPress Polls 1.2.4 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 22/10/2017 Vulnerable version: 1.2.4 Download Link :...

WordPress Plugin Polls 1.2.4 - SQL Injection (PoC)

Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Vulnerable version:Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip //////////////////////// /// Overview: //////////////////////// WordPress Polls plugin is a tool for creating polls and survey...

PT-2017-3501

Name of the Vulnerable Software and Affected Versions Cobbler versions up to 2.8.2 Description The issue is related to the lack of data sanitization in the add repo component of the Cobbler network installation server, which can be exploited by a remote attacker to execute arbitrary code with roo...

The vulnerability of the QTS operating system, allowing a perpetrator to execute arbitrary commands

The vulnerability of the QTS operating system is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

IDERA Uptime Monitor 7.8 - Multiple Vulnerabilities

IDERA Uptime Monitor 7.8 - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describe three 3 vulnerabilities found in IDERA Uptime Monitor version 7.8. “IDERA Uptime Monitor is a Proactively monitor physical servers, virtual machines, network devices, applications, and...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2016:3222-1)

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues : - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES - MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:3223-1)

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues : - MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES - MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution - MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating...

SUSE-SU-2016:3210-1 Security update for MozillaFirefox

MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM...

Cisco Webex Meetings Server Remote Command Execution Vulnerability

A vulnerability in Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to bypass security restrictions on a host located in a DMZ and inject arbitrary commands on a targeted system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a...

Horsys 8 Session Fixation / User Enumeration / XSS

Several Vulnerabilities founded in Horsys V8 Horsys is a human resource appliation, allowing the user to manage his profile, vacation, position title and other personnal data like address, phone number and so on. The application runs on Windows and launches a web server. This product has been...

Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS

This issue is similar to 119317, but happen on the server side data actionRemote. The function "parseHeaders" in remote.inc:38 don't sanitize the input received from the other server other side of the speed test. If the attacker started an speed test against a controlled server attacker itself an...

Cisco ASA VPN Portal Cross-Site Scripting

A cross-site scripting vulnerability has been reported in Cisco ASA VPN portal. The vulnerability is due to lack of data sanitization on URL parameters. A remote attacker can exploit this vulnerability by sending a specially crafted request to an affected server...