Simple Invoice 2011.1 Cross Site Request Forgery

Affected software: simple invoice Type of vulnerability:adding admin user via csrf URL:simpleinvoices.org Discovered by: provensec Website: provensec.com version:2011.1 Proof of concept...

PT-2015-1192

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 43.0.2357.65 Description The issue is related to errors in the HTMLConstructionSite.cpp file in the DOM implementation in Blink, used in Google Chrome. It allows remote attackers to bypass the Same Origin Policy...

PT-2015-4129

Name of the Vulnerable Software and Affected Versions IBM Rational ClearQuest versions 7.1.x through 7.1.2.17 IBM Rational ClearQuest versions 8.0.0.x through 8.0.0.14 IBM Rational ClearQuest versions 8.0.1.x through 8.0.1.7 Description A cross-site request forgery CSRF issue allows remote...

Agilent Technologies Feature Extraction AnnotationX.AnnList.1 ActiveX Control Arbitrary Code Execution Vulnerability

Agilent Technologies Feature Extraction is a set of feature extraction software for automatically reading and processing image files from multiple original chips from Agilent Technologies. A security vulnerability exists in Agilent Technologies Feature Extraction's AnnotationX.AnnList.1 ActiveX...

CVE-2015-2092

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

CVE-2015-2092: Improper Restriction of Operations within the Bounds of a Memory Buffer

The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

嘉缘人才系统sql注入#3

简要描述： 求20rank 详细说明： 首先看到frcms\member\requireslist.php if$do=="savedata" if$POST'id'=="" $POST'sid'=intval$Memberid; $POST'member'=getcookie'userlogin'; $POST'school'=getcookie'username'; ifempty$POST'title' showmsg'标题不能为空！','-1';exit; $POST'adddate'=date'Y-m-d H:i:s';...

PT-2015-5599

Name of the Vulnerable Software and Affected Versions Agilent Technologies Feature Extraction affected versions not specified Description The issue allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."...

(0Day) Agilent Technologies Feature Extraction ActiveX Control Index Out-Of-Bounds Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Agilent Technologies Feature Extraction. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

CVE-2014-2152

Cisco Prime Infrastructure (PI) contains a Cross-Site Request Forgery (CSRF) vulnerability on the INSERT page that could allow an unauthenticated/remote attacker to hijack the authentication of an authenticated PI user and perform actions on behalf of that user. Root cause is insufficient CSRF pr...

PT-2015-3700

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure PI affected versions not specified Description A cross-site request forgery CSRF issue in the INSERT page allows remote attackers to hijack the authentication of arbitrary users. Recommendations At the moment, there ...

PT-2015-3701

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in INSERT pages. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML vi...

CVE-2014-2153: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...

CVE-2014-2152: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the INSERT page in Cisco Prime Infrastructure PI allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCun21868...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

CVE-2015-1373

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

PT-2015-3632

Name of the Vulnerable Software and Affected Versions Savsoft Quiz affected versions not specified Description A cross-site request forgery CSRF issue exists in the index.php/user data/insert user endpoint, allowing remote attackers to hijack administrator authentication for requests that create...

PHPAPP注入第九枚（insert无视过滤）

简要描述： PHPAPP注入第九枚（insert无视过滤） 详细说明： 在wooyun上看到了有人提了PHPAPP的漏洞： http://wooyun.org/bugs/wooyun-2010-055604，然后去官网看了看，前几天刚有更新，就在官网下了PHPAPP最新的v2.6来看看2014-12-11更新的。 PSOT注入点：wwww.xxx.com/member.php?action=1&app=43&cid=2&rid=-1, 存在漏洞的文件在/phpapp/apps/refund/memberphpapp.php...

74cms最新版 二次注入

简要描述： 详细说明： 74cms 20141128最新版 漏洞文件:/wap/plus/wapajax.php 610-654行： elseif $act == 'invitedadd' $smarty-cache = false; $resume=resumeone$POST"resumeid"; $jobs=jobsone$POST"jobsid"; if$SESSION'utype'!=1 exit"企业会员请登录后邀请面试"; if checkinterview$POST"resumeid",$POST"jobsid",$SESSION'uid' exit"repeat";...