CVE-2017-17919: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

PT-2017-15098 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 5.1.4 and earlier Description: A SQL injection issue in the 'where' method allows remote attackers to execute arbitrary SQL commands via the id parameter. The vendor disputes this issue, citing that the method is not...

SQL Injection Vulnerability in the delProgram Method of the ChaseGrid WeChat Small Program App Store System

Chasing the grid WeChat small program application store system is a free open source small program store system developed by Chasing the grid technology. The delProgram method of the ChaseGrid WeChat applet store system suffers from a SQL injection vulnerability. Attackers can use the vulnerabili...

SQL Injection Vulnerability in the addProgram Method of ChaseGrid's WeChat Small Program App Store System

Chasing the grid WeChat small program application store system is a free open source small program store system developed by Chasing the grid technology. The addProgram method of the ChaseGrid WeChat applet store system has a SQL injection vulnerability. Attackers can use the vulnerability to...

Telesquare SKT LTE Router SDT-CS3B1 WebDAV HTTP Methods Arbitrary File Events

Summary We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G LTE wireless communication based LTE router product. Description WebDAV is enabled with directory listing and dangerous HTTP methods allowed: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK and UNLOCK. The HTTP PUT metho...

WordPress mgl-instagram-gallery Plugin Cross Site Scripting Vulnerability

Exploit for php platform in category web applications + Title: WordPress mgl-instagram-gallery Plugin Cross Site Scripting XSS + Author: Mostafa Gharzi + Vendor Homepage: www.Wordpress.org , www.pluginu.com/mgl-instagram-gallery/ + Tested on: Windows 10 & Kali Linux + Vulnerable File:...

Keyexchange error on Linux managed server after updating the kernel

Challenge Steps to correct Keyexchange errors on newly updated Linux managed server Cause Veeam SSH client caches both the Key and the encryption method. If the Linux kernel depreciates an encryption method when the kernel updates, connections to the managed server may fail with error such as...

Foxit Reader app.response method remote code execution vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the app.response method in Foxit Reader version 8.3.2.25013, where the program fails to adequately verify the existence of an object before performing an operation on i...

Foxit Reader XFA Layout Object pageSpan Method Remote Code Execution Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the pageSpan method of the XFA Layout object in Foxit Reader version 8.3.1.21155, which stems from the program failing to properly validate user-submitted data. A remot...

Foxit Reader XFA Layout object page method remote code execution vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the page method of the XFA Layout object in Foxit Reader version 8.3.1.21155, which results from the program failing to properly validate user-submitted data. A remote...

Foxit Reader openList Method Remote Code Execution Vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the openList method of the XFAScriptObject object in Foxit Reader version 8.3.1.21155, where the program fails to properly validate user-submitted data. The vulnerabili...

Foxit Reader append method remote code execution vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A security vulnerability exists in the append method of the XFA Node object in Foxit Reader version 8.3.1.21155, which is caused by the program failing to properly validate user-submitted data. A remote attacker can...

CVE-2017-16585

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-16586

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-16582

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-14830

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2017-14825

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Type confusion

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Type confusion

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Type confusion

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...