BEIMS ContractorWeb 5.18.0.0 SQL Injection

Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0 CVE : 2017-17721 Vulnerability Details:...

WordPress Spider Event Calendar 1.5.51 Blind SQL Injection

============================================= MGC ALERT 2017-003 - Original release date: April 06, 2017 - Last revised: April 10, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

CVE-2017-5155

An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by...

CVE-2017-5155

CVE-2017-5155 affects Schneider Electric Wonderware Historian (2014 R2 SP1 P01 and earlier). Root cause: historically created logins with default passwords can let a remote attacker compromise Historian databases and potentially SQL resources beyond. Impact: as described, unauthorized access and ...

New Windows Trojan Spreads MIRAI Malware To Hack More IoT Devices

MIRAI – possibly the biggest IoT-based malware threat that emerged last year, which caused vast internet outage in October last year by launching massive distributed denial-of-service DDoS attacks against the popular DNS provider Dyn. Now, the infamous malware has updated itself to boost its...

Zabbix 2.2.x3.0.x - SQL Injection

Zabbix 2.2.x3.0.x - SQL Injection ========================================== Title: Zabbix 3.0.3 SQL Injection Vulnerability Product: Zabbix Vulnerable Versions: 2.2.x, 3.0.x Fixed Version: 3.0.4 Homepage: http://www.zabbix.com Patch link: https://support.zabbix.com/browse/ZBX-11023 Credit:...

Rexroth Bosch BLADEcontrol-WebVIS SQL Injection Vulnerability

Rexroth Bosch BLADEcontrol is a web-based HMI system. Rexroth Bosch BLADEcontrol has a SQL injection vulnerability in database operations that could lead to control of the database server or remote code execution...

SQL Injection in GLPI

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in a popular Information Resource Manager IRM system GLPI. IRM systems are usually used for management and audit of software packages, providing ITIL-compliant service desk. The vulnerability allows remote...

Patron Info System SQL Injection

Document Title: =============== Patron Info System - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1784 Release Date: ============= 2016-03-21 Vulnerability Laboratory ID VL-ID: ==================================== 1784 Comm...

osCommerce 2.3.4 Local File Inclusion / Cross Site Request Forgery

Advisory ID: HTB23284 Product: osCommerce Vendor: osCommerce Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: December 21, 2015 without technical details Vendor Notification: December 21, 2015 Public Disclosure: February 17, 2016 Vulnerability Type: PHP Fi...

New Era Company CMS - (id) SQL Injection Vulnerability

Document Title: =============== New Era Company CMS - id SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1678 Release Date: ============= 2016-01-28 Vulnerability Laboratory ID VL-ID: ==================================== 1678...

WordPress CP Reservation Calendar Plugin 1.1.6 - SQL Injection

Exploit Title: WordPress: cp-reservation-calendar 1.1.6 SQLi injection Date: 2015-09-15 Google Dork: Index of /wp-content/plugins/cp-reservation-calendar/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link: https://downloads.wordpress.org/plugin/cp-reservation-calendar.z...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

GoAutoDial 3.3 multiple vulnerabilities

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

GoAutoDial SQL Injection / Command Execution / File Upload

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory:...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

某高校在用系统sql注入（DBA）（无需登录）

简要描述： 详细说明： WooYun: 某高校在用系统sql注入（打包）（DBA）（无需登录）2 上一个 注入文件fileformat.asp 参数txtFormatName 案例 202.195.243.37/tasi/admin/system/fileformat.asp --data "txtFormatName=sss&txtFormatExt=sss&txtFormatVersion=sss&cboFileType=1&formatid=0&action=add&btnSaveFormat=%B1%A3%B4%E6" -p txtFormatName...

CatBot v0.4.2 (PHP) - SQL Injection Vulnerability

Document Title: =============== CatBot v0.4.2 PHP - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1408 Release Date: ============= 2015-01-15 Vulnerability Laboratory ID VL-ID: ==================================== 1408 Commo...

CVE-2014-8682 Multiple Unauthenticated SQL Injections in Gogs

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Unauthenticated SQL Injection in Gogs repository search ======================================================= Researcher: Timo Schmid [email protected] Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go...