IMALL E-commerce Management System of Xiamen Techflood Software Co.

IMALL is an e-commerce management system of Xiamen Techflood Software Co. A design vulnerability exists in the IMALL e-commerce management system of Xiamen Techflood Software Co. An attacker can exploit the vulnerability to obtain database information and delete any order data in the database...

Shopify: Add signature to transactions without any permission

Hi, I found an endpoint for transaction signing but user permission not checked on this endpoint So an user without any permission in shop can add signature to transactions! Endpoint: /admin/securefiles.json Parameters:...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2016:2395-1)

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed : - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 - release...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:2404-1)

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed : - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and, under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 - release not...

SUSE-SU-2016:2395-1 Security update for mariadb

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed: CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 release notes:...

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. WordPress plugin Order Export Import for WooCommerce - Order has an information disclosure vulnerability. An attacker can exploit the vulnerability to download all orders...

Threat Outbreak Alert RuleID25085: Email Messages Distributing Malicious Software on September 20, 2016

Medium Alert ID: 48961 First Published: 2016 September 20 14:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25085 may contain the following files: Name ...

Windows Forensic Data Collection: IR-rescue

Windows Forensic Data Collection ir-rescue is a Windows Batch script that collects a myriad of forensic data from 32-bit and 64-bit Windows systems while respecting the order of volatility. It is intended for incident response use at different stages in the analysis and investigation process. It...

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure Exploit Title: WordPress Plugin Order Export Import for WooCommerce Link: https://wordpress.org/plugins/order-import-export-for-woocommerce/ Version: 1.0.8 Date: 19th 2016 Exploit Author: contact a david-peltier d...

Order Export Import for WooCommerce 1.0.8 - Order Information Disclosure

The Order Export & Order Import for WooCommerce WordPress plugin was affected by an Order Information Disclosure security vulnerability...

WordPress Order Export Import for WooCommerce Plugin - Order Information Disclosure

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Order Export Import for WooCommerce Link: https://wordpress.org/plugins/order-import-export-for-woocommerce/ Version: 1.0.8 Date: 19th 2016 Exploit Author: contact a david-peltier d fr Vendor Homepage:...

MyBB 1.8.6 - SQL Injection

MyBB 1.8.6 - SQL Injection Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes...

WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure

Exploit Title: WordPress Plugin Order Export Import for WooCommerce Link: https://wordpress.org/plugins/order-import-export-for-woocommerce/ Version: 1.0.8 Date: 19th 2016 Exploit Author: contact a david-peltier d fr Vendor Homepage: xadapter.com Version: 1.0.8 Timeline: Vuln found: 17-09-2016,...

WordPress Order Export Import Plugin <= 1.0.8 - Order Information Disclosure

This plugin is prone to an order information disclosure vulnerability. It allows attackers to export all order without being authenticated. Solution Update the plugin...

ALPINE-CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

MyBB 1.8.6 SQL Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: MyBB 1.8.6 Fixed in: 1.8.7 Fixed Version Link: http://resources.mybb.com/downloads/mybb1807.zip Vendor Website: http://www.mybb.com/ Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 01/29/2016...

UBUNTU-CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

Zend Framework vulnerable to SQL injection

Overview Zend Framework is an open source web application framework. Zend Framework 1 contains an SQL injection vulnerability CWE-89 due to a flaw in processing parameters in the ORDER BY and GROUP BY clauses. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC...

Potential SQL injection in ORDER and GROUP functions of ZF1

More info at https://framework.zend.com/security/advisory/ZF2016-03...

Threat Outbreak Alert RuleID24699: Email Messages Distributing Malicious Software on August 30, 2016

Medium Alert ID: 48669 First Published: 2016 August 30 18:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24699 may contain the following files: Name |...