3870 matches found
MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection
Exploit Title: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection Date: 2018-05-23 Software https://www.softneta.com/products/meddream-pacs-server/downloads.html Version: MedDreamPACS Premium 6.7.1.1 Exploit Author: Carlos Avila Google Dork: inurl:Pacs/login.php, inurl:pacsone...
WordPress Image Intense premium plugin <= 3.2.5 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability found in WordPress Image Intense premium plugin versions = 3.2.5. Solution 2018.09.05 - we were unable to find any information about the patched version of this plugin...
K7 Anti-Virus Premium Detection (Windows SMB Login)
Detects the installed version of K7 Anti-Virus Premium. The script logs in via smb, searches for K7 Anti-Virus Premium in the registry and gets the version from SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...
CVE-2017-3210
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the...
CVE-2017-3210
The CVE-2017-3210 issue affects Portrait Displays SDK services where pdiservice.exe runs with NT AUTHORITY/SYSTEM permissions and is writable by all Authenticated Users, enabling local privilege escalation. Affected applications include Portrait Display SDK-based tools such as Fujitsu DisplayView...
CVE-2017-3210 Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the...
JVN#41452671: The installers of multiple Canon IT Solutions Inc. software programs may insecurely load Dynamic Link Libraries
The installers of multiple software programs provided by Canon IT Solutions Inc. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Us...
The vulnerability of FTP servers of microprogrammed software-controlled Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 allows a intruder to gain access to the devices.
The vulnerability of FTP servers of microprogrammed logic controllers from Schneider Electric—Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200—is related to the use of pre-installed credentials. Exploiting this vulnerability can allow a malicious actor to gain access to the...
premium-nekretnine.com XSS vulnerability
Open Bug Bounty ID: OBB-625705 Description| Value ---|--- Affected Website:| premium-nekretnine.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Bumble: Compromising the user ID
Vulnerability allows to compromise the user ID in the "Dating" menu. This is a serious vulnerability that violates the logic of the site and allows the attacker to write a message to the user he likes before the user responds reciprocally. In order to play the vulnerability, you need to go to the...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
Schneider Electric PLCs - Cross-Site Request Forgery Vulnerability
Exploit for windows platform in category web applications Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Tested on: Windows CVE: CVE-2013-0663 Version: Schneider Electric Quantum PLC: 140NOE77111,...
Schneider Electric PLCs Cross Site Request Forgery
Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery Date: 2018-05-12 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Tested on: Windows CVE: CVE-2013-0663 Version: Schneider Electric Quantum PLC: 140NOE77111, 140NOE77101, 140NWM10000 Modicon M340 PLC...
Schneider Electric PLCs - Cross-Site Request Forgery
Schneider Electric PLCs - Cross-Site Request Forgery Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery Date: 2018-05-12 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Tested on: Windows CVE: CVE-2013-0663 Version: Schneider Electric Quantum PLC:...
Schneider Electric PLCs - Cross-Site Request Forgery
Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery Date: 2018-05-12 Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Tested on: Windows CVE: CVE-2013-0663 Version: Schneider Electric Quantum PLC: 140NOE77111, 140NOE77101, 140NWM10000 Modicon M340 PLC...
Prime95 29.4b8 - Stack Buffer Overflow (SEH)
Prime95 29.4b8 - Stack Buffer Overflow SEH Exploit Title: Prime95 Local Buffer Overflow SEH Date: 13-4-2018 Exploit Author: crashmanucoot Contact: twitter.com/crashmanucoot Vendor Homepage: https://www.mersenne.org/ Software Link: https://www.mersenne.org/download/download Version: 29.4b8 Tested...
GitLab: Persistent XSS - Selecting users as allowed merge request approvers
Summary: When using the dropdown that selects the users that are allowed to approve a merge request, it is possible to trigger a XSS with a malicious user name string. Description: This vulnerability is similar to the recently announced CVE-2018-10379 and another vulnerability I recently reported...
WordPress Web-Dorado Instagram Feed WD plugin cross-site scripting vulnerability (CNVD-2018-08291)
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Web-Dorado Instagram Feed WD plugin is a social media content sharing plugin used in ... A cross-site scripting...
WordPress WD #Instagram Feed Premium 1.3.0 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications WD Instagram Feed 1.3.0aaaXSS Vulnerabilities Two cross-site scripting vulnerabilities in the WD Instagram Feed WordPress plugin allow attackers to inject arbitrary web script or HTML by passing payloads through the bio of an Instagram profile...
