tcpdump: multiple overflow issues in protocol decoding

Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker could create a crafted pcap file or send specially crafted packets to the network segment where tcpdump is running in live capture mode without -w which...

CVE-2017-12064: Improper Encoding or Escaping of Output

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

Fortinet FortiWeb XSS Vulnerability (FG-IR-17-076)

Fortinet FortiWeb is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Friends in War Make or Break Authentication Bypass Vulnerability

Make or Break is a parenting blog. An authentication bypass vulnerability exists in Friends in War Make or Break. It allows an attacker to bypass login authentication via injection...

Friends In War Make Or Break 1.7 SQL Injection

Exploit Title: Friends in War Make or Break 1.7 SQL Injection Dork: N/A Date: 26.07.2017 Vendor : http://software.friendsinwar.com/ Software: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Demo: http://localhost/PATH/ Version: 1.7 Author: Ihsan Sencan SQL Injection/Exploit :...

Friends in War Make or Break 1.7 - CSRF (Change Admin Password) Vulnerability

Exploit for php platform in category web applications Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site:...

Friends In War Make Or Break 1.7 Password Change

Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.altervista.org/...

Friends in War Make or Break 1.7 - SQL Injection

Friends in War Make or Break 1.7 - SQL Injection Exploit Title: Friends in War Make or Break 1.7 SQL Injection Dork: N/A Date: 26.07.2017 Vendor : http://software.friendsinwar.com/ Software: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Demo: http://localhost/PATH/ Version: 1.7...

Ipswitch IMail Server SMTPD RCE Vulnerability (ETRE/ETCETERABLUE)

Ipswitch Collaboration Suite/IMail Server is prone to remote code execution RCE. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Friends in War Make or Break 1.7 - SQL Injection

Exploit Title: Friends in War Make or Break 1.7 SQL Injection Dork: N/A Date: 26.07.2017 Vendor : http://software.friendsinwar.com/ Software: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Demo: http://localhost/PATH/ Version: 1.7 Author: Ihsan Sencan SQL Injection/Exploit :...

Friends in War Make or Break 1.7 - Authentication Bypass

x Type: Admin login bypass via SQLi x Vendor: http://software.friendsinwar.com/ x Script Name: Make or Break x Script Version: 1.7 x Script DL: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 x Author: Anarchy Angel x Mail: anarchydotang31@gmaildotcom x More info:...

Trihedral VTScada Detection (HTTP)

HTTP based detection of Trihedral VTScada. Copyright C 2017 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation;...

USN-3302-1: ImageMagick vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could...

MasterCard Nearby - Certificates or keys found, Corrupted files, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application MasterCard Nearby published at the 'play' market has multiple vulnerabilities...

CVE-2017-8464

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK fil...

Splunk Enterprise alerts alerts_id Server-Side Request Forgery

A sever-side request forgery vulnerability exists in the alerts web interface of Splunk Enterprise. The vulnerability is due to a lack of validation on the alertsid parameter in HTTP requests sent to the alerts page. A remote, unauthenticated attacker can exploit this vulnerability by enticing an...

CVE-2017-9379: Cross-Site Request Forgery (CSRF)

Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php...

Starbucks: CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card

Hi, When a user registers with an option to get instant digital card, a card will be registered against that users name. There is CSRF in card removal process when user wants to report cards as stolen or lost. There is no CSRF protection on the post requests when...

CVE-2017-6650: Improper Input Validation

A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An...

EzToken - Certificates or keys found, Corrupted files, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application EzToken published at the 'play' market has multiple vulnerabilities...