Authentication flaw

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

CVE-2017-7682: Undefined Security Weakness

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

CVE-2017-7682

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

CVE-2017-7682

Summary: Apache OpenMeetings 3.2.0 is described as vulnerable to parameter manipulation attacks, enabling access to restricted areas (CVE-2017-7682). The Connected documents corroborate the same issue across multiple feeds (NVD, GHSA, OSV, CNVD, CNVD, etc.). Affected product/version: OpenMeetings...

PHP file inclusion in the back end

Date : 2017-07-12 CVE ID : CVE-2017-10993 Description A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server. Affected versions...

CVE-2017-1326

IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060...

EPSON TMNet WebConfig 1.00 - Cross-Site Scripting

Exploit Title: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 Google Dork: intitle:"EPSON TMNet WebConfig Ver.1.00" Date: 3/3/2017 Exploit Author: Michael Benich Vendor Homepage: https://www.epson-biz.com/ Software Link: https://c4b.epson-biz.com/modules/community/index.php?contentid=50 Versio...

family.tgifridays.co.uk XSS vulnerability

Vulnerable URL: https://family.tgifridays.co.uk/search?actions=search%2Fmap=%22%3E%3Cscript%3Ealert%28%22OPENBUGBOUNTY%22%29%3C%2Fscript%3E%3Cdiv+id%3D%22=10 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Public...

CVE-2016-5807: Improper Access Control

Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request...

CVE-2016-6209

A user supplied GET parameter is used to create the value used as the src value of an iframe displayed on all pages. It allows for CSRF and javascript insertion techniques among others. An attacker could forge a malicious URL that could include javascript execution in the main browser frame...

Soars-government system /TSPB/web/xzzx/xzzx. jsp parameter parentid SQL injection vulnerability

No description provided by source...

Dswjcms Lib/Action/Admin/BasisAction.class.php id parameter, etc. 9 SQL injection

No description provided by source...

Starbucks: Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.

@meals discovered a vulnerability which allowed the shipping address for teavana.com order subscriptions to be edited without proper authorization. Thanks @meals!...

Starbucks: Parameter Manipulation allowed for viewing of other user’s teavana.com orders

A vulnerability had existed which allowed for unauthorized viewing of order details belonging to other users. @meals delivered a solid report & worked with us to resolve the issue. Thanks @meals! Proper authorization checks were not done on a specific parameter that allowed any user on teavana.co...

科创CMS tpgl.jsp 参数chid SQL注入漏洞

利用payload： http://xxx/commfront/baixian/tpgl.jsp?chid=9076' AND 1067=SELECT UPPERXMLTypeCHR60||CHR58||CHR113||CHR120||CHR98||CHR120||CHR113||REPLACEREPLACEREPLACEREPLACESELECT NVLCASTUSER AS VARCHAR4000,CHR32 FROM...

Zend Framework < 2.0.8 / 2.1.x < 2.1.4 Multiple Vulnerabilities

Binary data 9146.prm...

ManageEngine EventLog Analyzer 10.8 Privilege Escalation

ManageEngine EventLog Analyzer v10.8 Date: 2/9/2016 Exploit Author: @GraphX Vendor Homepage: http://www.manageengine.com Version: 10.8 1 Description: It is possible for a remote authenticated attacker using an unprivileged account to gain access to the admin account via parameter manipulation usi...

Deliberately Insecure Web Application: OWASP WebGoat

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat in either J2EE or WebGoat for .Net in ASP.NET. In each lesson, users must demonstrate their understanding of a security issue by...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 srctrack, 2 usemfstmpsize, or 3 usemfsvarsize parameter to systemadvancedmisc.php; the 4 port, 5 snaplen, or 6 count parameter to diagpacketcapture.php...