Security Update for .NET Core SDK (Sep 2019)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x 2.1.509, or 2.1.606 or 2.1.802, 2.2.x 2.2.109 or 2.2.206 or 2.2.302. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability when .Net Core improperly handles web requests. An...

SQL Injection Vulnerability in MayiCMS

MayiCMS is a classified information system. MayiCMS suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to obtain sensitive information from the database...

CVE-2019-13447

An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection...

DEBIAN-CVE-2019-1010017

libnmap v0.6.3 is affected by: XML Injection. The impact is: Denial of service DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Vulnerability

Exploit for asp platform in category web applications Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1 Update-3 i.e.; 8.1 rev...

OLX: SQL Injection on https://www.olx.co.id

I found the SQL Injection on the website https://www.olx.co.id Affectected URL : https://www.olx.co.id/ajax/buybundle/getbundle/ POC: 1 In this below request i got SQL injection vulnerability in location parameter post method POST /ajax/buybundle/getbundle/ HTTP/1.1 Host: www.olx.co.id User-Agent...

SalesAgility SuiteCRM SQL Injection Vulnerability (CNVD-2019-16998)

SalesAgility SuiteCRM is a suite of enterprise-grade open source customer relationship management CRM. A SQL injection vulnerability exists in SalesAgility SuiteCRM versions 7.8.x prior to 7.8.30, 7.10.x prior to 7.10.17, and 7.11.x prior to 7.11.5, which can be exploited by an attacker to execut...

SQL Injection Vulnerability in the Website Building System of Qihang Internet Information Technology Co.

Ltd. is a Tianjin website construction company as well as a Tianjin network company. There is a SQL injection vulnerability in the website building system of Tianjin Enterprise Zhicheng Technology Co. An attacker can use the vulnerability to obtain sensitive information from the database...

UBUNTU-CVE-2019-5783

Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...

Joomla! objection injection attack vulnerability

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A vulnerability exists in Joomla! versions prior to 3.9.3 that can be exploited b...

The vulnerability of SAP Business Process Automation platform relates to errors in restricting XML references to external objects. This allows attackers to carry out attacks by injecting external XML entities into the system.

The vulnerability of the SAP Business Process Automation BPA platform relates to errors in restricting XML references to external objects, which are obtained from unverified sources. Exploiting this vulnerability allows a malicious actor to carry out an attack by injecting external XML entities a...

Shop7z Online Shopping System Fashion Edition Frontend Sh***.asp File SQL Injection Vulnerability

Shop7z online shopping system is to support Alipay, WeChat payment and a variety of commonly used interfaces, computer and cell phone version and APP seamless combination of data as a whole. Shop7z online shopping system fashion version of the front Sh.asp file SQL injection vulnerability...

PHP Uber-style GeoTracking 1.1 - SQL Injection

Exploit Title: PHP Uber-style GeoTracking 1.1 - SQL Injection Dork: N/A Date: 2019-01-21 Exploit Author: Ihsan Sencan Vendor Homepage: http://dataninja.biz Software Link: https://codecanyon.net/item/php-uberstyle-geotracking/20320021 Version: 1.1 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

Information Disclosure

sssd is vulnerable to information disclosure attacks. The vulnerability exists as it was found that sssd's sysdbsearchuserbyupnres function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash...

XML External Entity (XXE) To Read Files

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

SQL Injection Vulnerability in the Frontend Bi***.ashx Page of eDoc, an Electronic Document Repository

Electronic document library eDoc is a click document management system developed by Anhui Qixing Studio. Electronic Document Library eDoc front Bi.ashx page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive...

SQL Injection Vulnerability in CCTV Digital Resource Teaching Platform

CCTV digital resource teaching platform is to provide users with online teaching services. SQL injection vulnerability exists in CCTF Digital Resource Teaching Platform. An attacker can exploit the vulnerability to log in to the account system and obtain sensitive information from the database...

SQL Injection Vulnerability in Laoban CMS V2.0 ty***.php Page

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. A SQL injection vulnerability exists in the Laoban CMS V2.0 ty.php page. An attacker can exploit this vulnerability to obtain sensiti...

Budabot 4.0 - Denial of Service Exploit

Exploit Title: Budabot 4.0 - Denial of Service PoC Date: 2018-10-15 Exploit Author: Ryan Delaney Author Contact: email protected Vendor Homepage: http://budabot.com/ Software Link: http://budabot.com/forum/viewtopic.php?f=8&t=1413 Version: 0.6 - 4.0 Tested on: 4.0 CVE: CVE-2018-19290 1. Descripti...

CVE-2018-19290

In modules/HELPBOTMODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP daemon with a crafted command, resulting in a denial of service or possibly unspecified other impact, as demonstrated by the "!calc 5 x 5"...