CVE-2016-8375

An issue was discovered in Becton, Dickinson and Company BD Alaris 8015 Point of Care PC unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC unit. An unauthorized user with physical access to an affected Alaris PC unit may be able to obtain unencrypted wireless network authenticati...

Coursera: XSS Stored

Hi Coursera, This is AhsanKhan, An Ethical Hacker. I Have Found Stored XSS In Your Site : https://translate-coursera.org/ Now I Am Going To Show You. 1.Create An Account In Your Site. https://www.coursera.org 2.And Put This Script in First Name. " 3.Save it : 4.Account Created now Go to this Web...

Open-Xchange: IDOR - Accessing other user's attachements via PUT /appsuite/api/files?action=saveAs

Hello, I have found a request in witch a user is able to copy other user's pattachements in his own folders and after that, he is able to download them or he is able to email them to another address or able to view them in browser. POC ----------------- PUT...

InterContinental Hotels Confirms Credit Card Breach

InterContinental Hotels Group IHG, parent company to Crowne Plaza, Holiday Inn and Kimpton Hotels and Resorts, confirmed on Friday a breach of payment card systems used in 12 of its hotels located in North America and the Caribbean. According to IHG, which operates 5,000 hotels worldwide, malware...

Printing and Marketing Firm Leaks High-Profile Customers' Data

Franchise Services, the parent company of a number of large print and design companies, said it is investigating claims that sensitive customer data stored by one of its franchisees is accessible online. The data dates back to 2010 and ranges from sensitive health records belonging to a former...

Video Sharing Script 4.94 SQL Injection

Exploit Title: Video Sharing Script 4.94 a SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/video-sharing-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Itech Real Estate Script 3.12 - SQL Injection

Itech Real Estate Script 3.12 - SQL Injection Exploit Title: Itech Real Estate Script v3.12 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/real-estate-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Itech Auction Script 6.49 - 'mcid' SQL Injection

Exploit Title: Itech Auction Script v6.49 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/auction-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview...

CVE-2017-3418

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: User Interface. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technica...

CVE-2017-3395

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2017-3365

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

CVE-2017-3343

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTT...

CVE-2016-8312

Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications subcomponent: Product / Instrument Search. Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

Design/Logic Flaw

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite subcomponent: User Interface. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technica...

Design/Logic Flaw

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2017-3286

CVE-2017-3286 describes a vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: Patching). Affected supported versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. The description states that an easily exploitable vulnerability could allow a high-privi...

CVE-2017-3293

CVE-2017-3293 is a Use-After-Free vulnerability in the Oracle Outside In Technology (Outside In Filters) used by Oracle Fusion Middleware. Affected versions include 8.5.2 and 8.5.3. The issue arises in the RTF/Outside In Filters parsing path where freed memory can be reused (notably during handli...

CVE-2017-3297

The CVE-2017-3297 entry concerns Oracle FLEXCUBE Direct Banking (subcomponent: Framework). Affected versions are 12.0.2 and 12.0.3. The vulnerability is described as difficult to exploit, allowing a low-privilege attacker with network access via HTTP to compromise Oracle FLEXCUBE Direct Banking, ...

CVE-2017-3359

CVE-2017-3359 affects Oracle E-Business Suite’s Oracle Customer Intelligence (User Interface), specifically versions 12.1.1–12.1.3. The vulnerability allows network-access, unauthenticated or semi-authenticated access via HTTP to compromise Oracle Customer Intelligence; attacks may leverage user ...

CVE-2017-3359

Vulnerability in the Oracle Customer Intelligence component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...