phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)

phpMyAdmin 4.8.1 - Authenticated Local File Inclusion 1 The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 5563 lines Line 61 contains include $REQUEST'target'; This is obviously LFI precursor, as lon...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection (CVE-2018-1414)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2018-1414 DESCRIPTION: IBM Maximo...

Security Bulletin: Blind SQL injection vulnerability in IBM OpenPages GRC Platform API (CVE-2015-5049)

Summary A blind SQL injection vulnerability has been found in the OpenPages GRC Platform API that could allow retrival or manipulation of information in the database. Vulnerability Details CVEID: CVE-2015-5049 DESCRIPTION: IBM OpenPages GRC Platform is vulnerable to SQL injection. A remote attack...

CVE-2017-3968

Session fixation vulnerability in the web interface in McAfee Network Security Manager NSM before 8.2.7.42.2 and McAfee Network Data Loss Prevention NDLP before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie...

CVE-2017-3968 McAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerability

Session fixation vulnerability in the web interface in McAfee Network Security Manager NSM before 8.2.7.42.2 and McAfee Network Data Loss Prevention NDLP before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie...

CVE-2017-3968

CVE-2017-3968 concerns a session fixation vulnerability in the web interface of McAfee Network Security Manager (NSM) and Network Data Loss Prevention (NDLP). The issue allows remote attackers to disclose sensitive information or manipulate the underlying database by exploiting a crafted authenti...

HP Network Automation SQL Injection Vulnerability (CNVD-2018-12120)

HP Network Automation Software is network configuration and management automation software. A SQL injection vulnerability exists in HP Network Automation, which could be exploited by remote attackers to submit a specially crafted SQL request to manipulate a database, obtain sensitive information,...

CVE-2017-3965 SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability

Cross-Site Request Forgery CSRF aka Session Riding vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted...

SemCms web_email.php file incomplete fix exists SQL injection vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SemCms webemail.php file is not...

Sql injection

IBM Financial Transaction Manager FTM for Multi-Platform MP 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID:...

Sql injection

IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683...

CVE-2017-1356

IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683...

Cross site scripting

A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...

CVE-2017-6789

A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...

finecms SQL injection vulnerability (CNVD-2017-28415)

FineCMS is a website building system based on PHP+MySql+CI framework. A SQL injection vulnerability exists in the controllersmemberContentController.php page in Finecms, which can be exploited by remote attackers to manipulate the website database...

Open Ticket Request System Reload Vulnerability

OTRS Open Technology Real Service is an open source help desk and IT service management solution. OTRS suffers from a reinstallation vulnerability. Because the program does not validate the installation, an attacker can exploit the vulnerability to reinstall the system and directly manipulate the...

Piwigo Facetag 0.0.3 SQL Injection

Exploit Title: Facetag Extension in Piwigo, Multiple SQL injection Date: 30-05-2017 Extension Version: 0.0.3 Software Link: http://piwigo.org/basics/downloads Extension link : http://piwigo.org/ext/extensionview.php?eid=845 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh2...

Sql injection

IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference : 1992067...

SQL Injection

loopback-connector-mssql is vulnerable to SQL injection attacks. This is because user-supplied inputs are not properly sanitized before using them in SQL queries, allowing a remote attacker to inject or manipulate SQL queries in the back-end database...

Ipswitch WhatsUp Gold < 16.5.0 WrFreeFormText.asp sUniqueID Parameter Blind SQLi (credentialed)

According to its self-reported version number, the Ipswitch WhatsUp Gold application installed on the remote host is prior to 16.5.0. It is, therefore, affected by a SQL injection vulnerability within file WrFreeFormText.asp due to improper sanitization of user-supplied input to the 'sUniqueID'...