Design/Logic Flaw

Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter...

Sql injection

Multiple SQL injection vulnerabilities in Misys FusionCapital Opics Plus allow remote authenticated users to execute arbitrary SQL commands via the 1 ID or 2 Branch parameter...

CVE-2016-5654

Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter...

CVE-2016-5655

Misys FusionCapital Opics Plus suffers from improper certificate validation (CVE-2016-5655): the component does not verify X.509 certificates from SSL servers, enabling MITM and potential exposure of sensitive data. Affected product is Misys FusionCapital Opics Plus; the vulnerability allows an a...

CVE-2016-5654

Misys FusionCapital Opics Plus is affected by CVE-2016-5654. A remote authenticated attacker could exploit a man-in-the-middle to tamper with the xmlMessageOut parameter and escalate privileges to administrator. The issue is tied to Misys FusionCapital Opics Plus and is described in CNVD/CERT ent...

CVE-2016-5653

CVE-2016-5653 affects Misys FusionCapital Opics Plus. Descriptions in multiple sources confirm SQL injection vulnerabilities allowing remote authenticated users to execute arbitrary SQL commands via the ID or Branch parameters in a search. Impact: attacker could enumerate the database and, in con...

Misys FusionCapital Opics Plus contains multiple vulnerabilities

Overview Misys FusionCapital Opics Plus is used by regional and local financial institutions to manage treasuries. FusionCapital Opics Plus contains several vulnerabilities. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' -...

ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting XSS vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSSOPERATION' parameter. An unauthenticated, remote attacker can exploit this, v...

DEBIAN-CVE-2016-4463

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD...

The vulnerability of Microsoft Lync Server software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the GDI+ component of the Microsoft Lync Attendee User program, related to the processing of specially crafted images, allows for remote execution of code when a user opens a specially crafted image. Exploiting this vulnerability enables a malicious individual to gain full...

The vulnerability of Cisco PIX software allows a malicious individual to trigger a service failure.

Overloading the buffer in the Cisco PIX Firewall allows malicious actors operating remotely to trigger service failures by using authentication for HTTP traffic via TACACS+ or RADIUS...

The vulnerability of the Microsoft Lync Attendee User software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the GDI+ component in Microsoft Lync Attendee User allows for remote execution of code, provided that the user opens a specially crafted image. Exploiting this vulnerability enables a malicious individual to gain full control over the system. They can then install programs,...

WordPress WP Photo Album Plus Plugin <= 5.4.4 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...

General Purpose Blocker: uBlock

General Purpose Blocker An efficient blocker for Chromium and Firefox. Fast and lean. uBlock Origin or uBlock₀ is not an ad blocker ; it’s a general-purpose blocker. uBlock₀ blocks ads through its support of the Adblock Plus filter syntax . uBlock₀ extends the syntax and is designed to work with...

Sky Plus Estonia - AWS Credentials, Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Sky Plus Estonia published at the 'play' market has multiple vulnerabilities...

Moxa Discontinuing Vulnerable Line of ICS Devices

A vulnerability that exists in embedded computers manufactured by Moxa could allow remote authenticated users to overwrite firmware, in turn rendering the devices unusable. Moxa, a Taiwan-based networking company, announced recently that instead of patching the line of products affected by the...

CVE-2016-4500

Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access...

CVE-2016-4500

The CVE-2016-4500 entry concerns Moxa UC-7408 LX-Plus devices where remote authenticated users can write to the firmware and render a device unusable by leveraging root access. Technical details indicate missing authentication for critical function (CWE-306) enabling a firmware overwrite that is ...

WordPress Q and A Focus Plus FAQ Plugin 1.3.9.7 - Multiple Vulnerabilities

Q and A Focus Plus FAQ plugin is prone to full path disclosure and SQL injection vulnerabilities. Solution Upgrade the plugin...

WordPress Plugin Q and A (Focus Plus) FAQ 1.3.9.7 - Multiple Vulnerabilities

Exploit Title: WordPress Q and A Focus Plus FAQ Full Path Disclosure and SQL Injection Google Dork: inurl:"wp-content/plugins/q-and-a" Date: 12-05-2016 Software Link: https://wordpress.org/plugins/q-and-a-focus-plus-faq/ Version: 1.3.9.7 and prior Exploit Author: Gwendal Le Coguic Website:...