Hanchao B2B2C Multi-User Mall System v2.1.3 SQL Injection Vulnerability in the del_msg method

Hanchao B2B2C multi-user mall system is a PHP multi-user mall website system source code developed in PHP + MySQL. Hanchao B2B2C Multi-User Mall System v2.1.3 SQL injection vulnerability exists in the delmsg method. An attacker can exploit this vulnerability to obtain database information...

Behind the CARBANAK Backdoor

In this blog, we will take a closer look at the powerful, versatile backdoor known as CARBANAK aka Anunak. Specifically, we will focus on the operational details of its use over the past few years, including its configuration, the minor variations observed from sample to sample, and its evolution...

portaldelusuario.sbs.gob.ec XSS vulnerability

Vulnerable URL: http://portaldelusuario.sbs.gob.ec/categoria.php?idcategoria=3%22%3E%3Cimg%20src=x%20onerror=prompt%22OPENBUGBOUNTY%22;%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

PT-2018-7120

Name of the Vulnerable Software and Affected Versions: ipa versions prior to 4.4 Description: A flaw was discovered in the way IdM's ca-del, ca-disable, and ca-enable commands handle user permissions when modifying CAs in Dogtag. This issue allows an authenticated, unauthorized attacker to delete...

PT-2015-7576

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...

Electric Sheep Fencing Pfsense WebGUI Cross-Site Scripting Vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in the WebGUI of Electric Sheep Fencing pfSense versions prior to 2.2.3, which stems from the servicescaptiveportalzones.php...

KPPW最新版SQL注入漏洞四(同一问题引发多处注入及越权含分析）

简要描述： KPPW最新版SQL注入漏洞四同一问题引发多处注入及越权） 详细说明： KPPW最新版SQL注入漏洞四同一问题引发多处注入及越权） 文件/control/user/accountreport.php $objReportT = keketableclass::getinstance'witkeyreport'; if isset $action switch $action case 'mulitDel' : if $ckb $objTaskT-del 'taskid', $ckb ; kekezu::showmsg '删除成功', $strUrl, NULL, NULL,...

CVE-2014-7742

The Noticias del Vaticano aka com.wNoticiasdelVaticano application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7742

The CVE-2014-7742 entry describes a vulnerability in the Noticias del Vaticano (com.wNoticiasdelVaticano) Android app version 0.1 where SSL certificate validation is not performed. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate....

CVE-2014-7742

The Noticias del Vaticano aka com.wNoticiasdelVaticano application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-8228

Name of the Vulnerable Software and Affected Versions Noticias del Vaticano aka com.wNoticiasdelVaticano version 0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

CVE-2014-7742: Undefined Security Weakness

The Noticias del Vaticano aka com.wNoticiasdelVaticano application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6901

The RADIOS DEL ECUADOR aka com.nobexinc.wls87612622.rc application 3.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6901

The CVE-2014-6901 entry concerns the Android app RADIOS DEL ECUADOR (package com.nobexinc.wls_87612622.rc), version 3.2.4. The root cause is that the application does not verify X.509 certificates from SSL servers, which can permit man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-6901

The RADIOS DEL ECUADOR aka com.nobexinc.wls87612622.rc application 3.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6901: Undefined Security Weakness

The RADIOS DEL ECUADOR aka com.nobexinc.wls87612622.rc application 3.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7577

Name of the Vulnerable Software and Affected Versions RADIOS DEL ECUADOR aka com.nobexinc.wls 87612622.rc version 3.2.4 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

LivePerson Cross Site Scripting

Exploit Title: LivePerson Cross Site Scripting Date: 15.03.2012 Author: Sony Software Link: http://liveperson.com/ Google Dorks: inurl:/window/top.asp?site= or inurl:/window/main.asp?site= Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC:...

How to hack Internet cafe charging system in the cafe on the Overlord network-vulnerability warning-the black bar safety net

One with Alt+Ctrl+Del key combination（Vientiane） After the boot, when appears the blue background, immediately press the key combination, pop-up“close Program”dialog box, if inside a“client”after the immediately closed, when the discovery of the“unknown”program is also closed because of Vientiane...

Telephone Directory 2008 Arbitrary Delete Contact Exploit

Exploit for unknown platform in category web applications ========================================================= Telephone Directory 2008 Arbitrary Delete Contact Exploit ========================================================= !/usr/bin/perl -w Telephone Directory 2008 see down Greetz :...