Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Monstra-Dev 3.0.4 - Cross-Site Request Forgery Account Hijacking Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10...

openSUSE Security Update : java-10-openjdk (openSUSE-2018-810)

This update for OpenJDK 10.0.2 fixes the following security issues : - CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data...

Oracle Fusion Middleware Business Process Management Suite Component Access Control Error Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, and other functionality.Business Process Management Suite is one of the business process management Business...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39911)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking, and property management.Oracle FLEXCUBE Enterprise Limits and Collateral Oracle FLEXCUBE Enterprise Limits and Collateral Management is one of the components used to...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management Component Access Control Error Vulnerability

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...

Oracle Financial Services Applications Banking Corporate Lending Component Access Control Error Vulnerability (CNVD-2019-39910)

Oracle Financial Services Applications is the United States Oracle Oracle company's set of core banking, online banking and property management in one of the financial services software. Banking Corporate Lending is one of the bank loan management components. An access control error vulnerability...

Oracle Financial Services Applications Banking Corporate Lending Component Access Control Error Vulnerability (CNVD-2019-39917)

Oracle Financial Services Applications is the United States Oracle Oracle company's set of core banking, online banking and property management in one of the financial services software. Banking Corporate Lending is one of the bank loan management components. An access control error vulnerability...

Oracle Hospitality Applications Hospitality Cruise Fleet Management System Component Access Control Error Vulnerability (CNVD-2019-39928)

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle Corporation. The solution provides human resource cost management, provides tracking and management of customer services throughout the journey to improve...

WityCMS 0.6.2 Cross Site Request Forgery

...

Oracle Hospitality Applications Hospitality Simphony Component Access Control Error Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hotel management from Oracle. Hospitality Simphony is one of the cloud-based hotel management components. An access control error vulnerability exists in the Oracle Hospitality Applications...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)

input type="hidden" name="type" value=...

CVE-2016-8640

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...

PYSEC-2018-98

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...

DEBIAN-CVE-2016-8640

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL at least it is possible to perform updates/inserts/deletes and database...

Design/Logic Flaw

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource...

CVE-2018-1999037

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource...

CVE-2018-1999032

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

CVE-2018-1999037

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource...

Design/Logic Flaw

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

CVE-2018-1999032

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...