Mango Automation 2.6.0 Add Admin Cross Site Request Forgery

Mango Automation 2.6.0 CSRF Add Admin Exploit Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...

Mango Automation 2.6.0 SQL Query Cross Site Request Forgery

Mango Automation 2.6.0 CSRF Arbitrary SQL Query Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allo...

Mango Automation 2.6.0 File Upload / Code Execution CSRF

Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software...

Mango Automation 2.6.0 User Enumeration Weakness

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The weakness is caused due to...

Mango Automation 2.6.0 CSRF Arbitrary SQL Query Execution

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The application allows users ...

Mango Automation 2.6.0 Unprotected Debug Log View Vulnerability

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description Mango Automation suffers from...

Important: Red Hat Security Advisory: qemu-kvm-rhev security update

Updated qemu-kvm-rhev packages that fix one security issue are now available for Red Hat Enterprise Virtualization Hypervisor 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

VMware vCenter 6.0 LDAP Certificate Validation MitM Spoofing (VMSA-2015-0006)

The VMware vCenter Server installed on the remote host is version 6.0 prior to 6.0u1. It is, therefore, affected by a man-in-the-middle spoofing vulnerability due to improper validation of X.509 certificates from TLS LDAP servers. A remote, man-in-the-middle attacker can exploit this to intercept...

Debian DSA-3361-1 : qemu - security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process crash. - CVE-2015-5279...

JVN#24517322: Koritore vulnerable to URL whitelist bypass

Koritore provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". Koritore contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Impact Android version of this app may allow an applican API to b...

JVN#19948778: Photon vulnerable to URL whitelist bypass

Photon provided by Newphoria Corporation Inc. is an application for Android built using "applican". Photon contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Impact Android version of this app may allow an applican API to be executed if th...

JVN#83862346: MEGAPHONE MUSIC vulnerable to URL whitelist bypass

MEGAPHONE MUSIC provided by Newphoria Corporation Inc. is an application for both iOS or Android built using "applican". MEGAPHONE MUSIC contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme. Impact Android version of this app may allow an...

Shopify Input Validation

Document Title: =============== Shopify Bug Bounty 8 - FilePath Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1592 Release Date: ============= 2015-09-04 Vulnerability Laboratory ID VL-ID: ====================================...

JVN#07427376: PIXMA MG7500 Series vulnerable to cross-site request forgery

PIXMA MG7500 Series provided by Canon Inc. contain a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged into the Remote UI, unintended operations may be performed. Solution Apply a Workaround The following workaround can mitigate the affects of this...

Paypal Inc - Open Redirect Web Vulnerability

Document Title: =============== Paypal Inc - Open Redirect Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1598 Vulnerability Magazine:...

Paypal Inc - Open Redirect Web Vulnerability

Document Title: =============== Paypal Inc - Open Redirect Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1598 Vulnerability Magazine:...

JVN#09283606: desknet's NEO vulnerable to directory traversal

desknet's NEO provided by NEOJAPAN Inc. contains a directory traversal CWE-22 vulnerability where it fails to verify html parameter in zhtml.cgi. Impact An authenticated attacker may view arbitrary files on the server. Solution Update the Software Update to the latest version according to the...

XGI Windows VGA Display Manager 6.14.10.1090 - Arbitrary Write PoC

Exploit for windows platform in category dos / poc Title: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-004.txt 1. Vulnerability Details Affected Vendor: Silicon Integrated Systems Corporation...

Popular Download Service μTorrent wants you to pay for its Software

Just to enhance the services being rendered. The popular peer-to-peer file sharing software application is aiming to achieve new heights by making their software be a paid scheme. uTorrent is one of the clients of BitTorrent Inc. the parent company which implements a BitTorrent protocol. Where ea...

up.time 7.5.0 Superadmin Privilege Escalation

up.time 7.5.0 Superadmin Privilege Escalation Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: up.time suffers from a privilege escalation issue. Normal user...