CVE-2018-5988

CVE-2018-5988 affects Flexible Poll 1.2. The vulnerability is a SQL Injection in the id parameter of mobile_preview.php and index.php, caused by unsafely handling user-supplied input. Impact per sources: remote attacker can inject SQL commands, with potential data exposure/integrity effects as de...

Flexible Poll 1.2 SQL Injection

Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5988 Exploit Author: Ihsan Sencan Author...

CVE-2018-5988: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobilepreview.php or index.php...

Flexible Poll 1.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CV...

PT-2018-17274

Name of the Vulnerable Software and Affected Versions: Flexible Poll version 1.2 Description: A SQL Injection issue exists, allowing exploitation via the id parameter to "mobile preview.php" or "index.php" API endpoints. Recommendations: For Flexible Poll version 1.2, avoid using the id parameter...

Flexible Poll 1.2 - SQL Injection

Flexible Poll 1.2 - SQL Injection Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5988...

Flexible Poll 1.2 - SQL Injection

Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5988 Exploit Author: Ihsan Sencan Author...

Discuz! DiscuzX cross-site scripting vulnerability

Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4. A remote attacker can exploit this vulnerability by sending the 'view' parameter to the include/space/spacepoll.php file to inject arbitrary Web script or HTML...

CVE-2018-5331

Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/spacepoll.php, as demonstrated by a mod=space do=poll request to home.php...

Another Facebook Bug Allowed Anyone to Delete Your Photos

If you think a website whose value is more than $500 billion does not have any vulnerability in it, then you are wrong. Pouya Darabi, an Iranian web developer, discovered and reported a critical yet straightforward vulnerability in Facebook earlier this month that could have allowed anyone to...

CloudBees Poll SCM Plugin Cross-Site Request Forgery Vulnerability

CloudBees Poll SCM Plugin is the United States CloudBees company Jenkins Java-based development of continuous integration tools in a timed execution plugin . The CloudBees Poll SCM Plugin suffers from a cross-site request forgery vulnerability that stems from the program failing to require a POST...

Network Time Protocol Broadcast Mode Poll Interval Enforcement Denial of Service Vulnerability(CVE-2016-7428)

Summary An exploitable denial of service vulnerability exists in the broadcast mode poll interval enforcement functionality of ntpd. To limit abuse, ntpd restricts the rate at which each broadcast association will process incoming packets. ntpd will reject broadcast mode packets that arrive befor...

CVE-2017-1000093

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it...

Cross site request forgery (csrf)

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it...

CVE-2017-1000093: Cross-Site Request Forgery (CSRF)

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it...

CVE-2017-1000093

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it...

CVE-2017-1000093

Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it...

CVE-2017-1000093

Summary: CVE-2017-1000093 pertains to the Jenkins Poll SCM Plugin, which failed to require API requests to be sent via POST, exposing it to Cross-Site Request Forgery attacks. This could allow an attacker to initiate polling of projects with a known name. The issue undermines the plugin’s permiss...

PT-2017-10798

Name of the Vulnerable Software and Affected Versions Jenkins Poll SCM Plugin affected versions not specified Description The issue allows attackers to initiate polling of projects with a known name due to the plugin not requiring requests to its API to be sent via POST, making it vulnerable to...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-1062) (BlueBorne)

The openSUSE Leap 42.2 kernel was updated to 4.4.87 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel BlueZ was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration...