Design/Logic Flaw

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. There is no salt for password hashing. Indeed passwords are stored without being ciphered with a timestamped ciphering method...

CVE-2017-13701

Affected product: MOXA EDS-G512E (5.1 build 16072215). Issue: backup files store passwords without salt and with an insecure, timestamped ciphering method, enabling exposure of credentials. Impact: high confidentiality and integrity concerns; CVSS-3.0 base score 9.8 (CRITICAL), network attack vec...

School CMS 1.0.0 Cross Site Scripting

| | Exploit Title: school cms Cross Site Scripting | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : https://www.sourcecodester.com/php/5400/school-website-cms.html | Software Link: https://www.sourcecodester.com/sites/default/files/download/arukumar/schoolcms.zip | Version:...

PT-2017-10916

Name of the Vulnerable Software and Affected Versions soyuka/pidusage versions 1.1.4 and earlier Description The issue allows for command injection in the module, resulting in arbitrary command execution. Affected versions of pidusage pass unsanitized input to child process.exec, leading to...

Microsoft Edge Charka JIT Incorrect Check

Microsoft Edge: Chakra: JIT: Incorrect integer overflow check in Lowerer::LowerBoundCheck CVE-2017-11861 Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset,...

Zeta Components Mail 1.8.1 - Remote Code Execution

Zeta Components Mail 1.8.1 - Remote Code Execution Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into...

PT-2017-14594

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "MyPage.do?method=viewDashBoard" endpoint for the forpage parameter. Recommendations For Zoho ManageEngine Applications...

CVE-2017-16849: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...

Zeta Components Mail 1.8.1 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: 'email protected -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into...

CVE-2017-16846: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

Zeta Components Mail 1.8.1 - Remote Code Execution

Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into /var/www/html/cache/exploit.php. The resulting file will contain t...

PT-2017-13702

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.1.21155 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

PT-2017-13703

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.1.21155 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

PT-2017-14466

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.2.25013 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

PT-2017-13711

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.1.21155 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

Foxit Reader XFAScriptObject insert Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the insert method o...

Foxit Reader App response Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the app.response...

PT-2017-13699

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.1.21155 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

PT-2017-13700

Name of the Vulnerable Software and Affected Versions Foxit Reader version 8.3.1.21155 Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The fla...

Monstra CMS 3.0.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications | | Exploit Title: Monstra cms Cross Site ScriptingXSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : http://monstra.org/ | Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip | Version: 3.0.4 ...