117 matches found
Directory Traversal
Apache Drill is vulnerable directory traversal attacks. The application is does not prevent user queries from accessing paths outside of their workspace, allowing a malicious user to traverse the directory...
Apache Drill Cross-Site Scripting Vulnerability
Apache Drill is a schema-less SQL query engine for Hapood, NoSQL and cloud storage from the Apache Apache Software Foundation. The product supports a variety of NoSQL databases and file systems , including HBase, MongoDB, MapR-DB, HDFS and MapR-FS and so on. A cross-site scripting vulnerability...
Design/Logic Flaw
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
CVE-2017-12630
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
CVE-2017-12630
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
CVE-2017-12630
CVE-2017-12630 affects Apache Drill 1.11.0 and earlier. The vulnerability is a cross-site scripting issue where submitting a form from the Query page allows an attacker to inject arbitrary script/HTML, which can then execute on the Profile page and potentially expose cookie information. The conne...
CVE-2017-12630
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
Spoofable Clients
Apache Drill clients are vulnerable to being spoofed. When authenticating with a server, the configuration is not checked. This means if an attacker sets up a drillbit url with no authentication to spoof requests coming from a secured drillbit url, the connection will return as a success...
Cross-site Scripting (XSS)
Apache Drill is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input string in the query page or in the profile page, allowing a malicious user to inject and execute arbitrary Javascript...
This Week in Security News
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...
rai-hotelservice.com XSS vulnerability
Vulnerable URL: https://www.rai-hotelservice.com/compass/external/index.cfm?fuseaction=dsphoteldrilldown...
Internet-Enabled Drill Demonstrates IoT Security Done Right
To Mark Loveless, an internet-enabled cordless drill seemed like a perfect recipe for an IoT security nightmare. Duo Security’s senior security researcher confessed that it sounded silly and quite possibly part of a push by the electronics maker to inject “smarts” into devices that ultimately...
M-Drill - Suspicious files, WebView JavaScript enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application M-Drill published at the 'play' market has multiple vulnerabilities...
Webfwlog - Firewall Log Analyzer
Webfwlog is a flexible web-based firewall log analyzer and reporting tool. It supports standard system logs for linux, FreeBSD, OpenBSD, NetBSD, Solaris, Irix, OS X, etc. as well as Windows XP®. Supported log file formats are netfilter, ipfilter, ipfw, ipchains and Windows XP®. Webfwlog also...
Easy day technology Mall 2.1 Free Edition IIS6 parsing exploits-vulnerability warning-the black bar safety net
Easy day micro Mall is E-day technologies the only official service website. Provide professional e-Commerce service,including a free online store system,supply information publishing system design and development and provide Taobao brush drill Service,Shop Agent extension services. The exploit:...
myevent-xss.txt
░░░▒▒▒▓▓▓▓█████████████████████████████████████████████████████▓▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓▓ ▓▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓▓ XSS Vulnerability ▓▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓▓ myEvent viewevent.php XSS Vulnerability ▓▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓▓ http://mywebland.com/ ▓▓▓▓▒▒▒░░░ ░░░▒▒▒▓▓▓▓ ▓▓▓▓▒▒▒░░░...
