22 matches found
EUVD-2017-6834
Malware in sbrugna...
EUVD-2017-6831
Malware in sbrugna...
EUVD-2017-6833
Malware in sbrugna...
CVE-2017-15373
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php aka the search private area...
Sql injection
SQL Injection exists in the E-Sic 1.0 password reset parameter aka the cpfcnpj parameter to the /reset URI...
CVE-2017-15378
SQL Injection exists in the E-Sic 1.0 password reset parameter aka the cpfcnpj parameter to the /reset URI...
Cross site scripting
XSS exists in the E-Sic 1.0 /cadastro/index.php URI aka the requester's registration area via the nome parameter...
Sql injection
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...
Authentication flaw
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15381
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...
CVE-2017-15380
XSS exists in the E-Sic 1.0 /cadastro/index.php URI aka the requester's registration area via the nome parameter...
CVE-2017-15380
The CVE-2017-15380 entry corresponds to a cross‑site scripting (XSS) vulnerability in E‑SIC version 1.0, exploitable via the /cadastro/index.php registration page and the nome parameter. Public references indicate a potential remote script injection vector, with impacts limited to user context (n...
CVE-2017-15381
CVE-2017-15381 affects E-Sic 1.0, with a SQL Injection vulnerability in the f parameter of esiclivre/restrito/inc/buscacep.php (zip code search). Root cause: unsanitized input in the f parameter leads to arbitrary SQL execution. Exploitation context: remote network exploitation; impact described ...
CVE-2017-15379
An authentication bypass exists in the E-Sic 1.0 /index aka login URI via '=''or' values for the username and password...
CVE-2017-15379
The CVE-2017-15379 entry covers an authentication bypass in E-Sic 1.0 at the /index (login) endpoint, exploitable via the username/password parameters using values like '=' or 'or'. Affected product: E-Sic 1.0; root cause: improper input validation in the login URI allows bypass of authentication...
CVE-2017-15381
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...
PT-2017-14035 · E Sic · E-Sic
Name of the Vulnerable Software and Affected Versions: E-Sic version 1.0 Description: An authentication bypass issue exists due to the acceptance of '=' or ' values for the username and password variables in the "/index" also known as "login" API endpoint. Recommendations: For E-Sic version 1.0, ...
Sql injection
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php aka the search private area...
CVE-2017-15373
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php aka the search private area...