Design/Logic Flaw

Hue 3.12 has XSS via the /pig/save/ name and script parameters...

CVE-2018-11649

Hue 3.12 has XSS via the /pig/save/ name and script parameters...

ClipperCMS Cross-Site Scripting Vulnerability

ClipperCMS is a content management system CMS. A cross-site scripting vulnerability exists in the 'Site Name' field of the 'site' tag under configuration in ClipperCMS version 1.3.3. A remote attacker can exploit this vulnerability by sending a specially crafted site name to the...

Code execution vulnerability in LOGA version 5.3.1

LOGA that is named "Limit Of Good AsThis" is a multi-language, multi-platform building system developed by Nuance. A code execution vulnerability exists in LOGA version 5.3.1. The vulnerability is caused by the program's failure to filter the saved content when saving configuration files, an...

save-video.com XSS vulnerability

Open Bug Bounty ID: OBB-610623 Description| Value ---|--- Affected Website:| save-video.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

save-food.de XSS vulnerability

Open Bug Bounty ID: OBB-608106 Description| Value ---|--- Affected Website:| save-food.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

Cross site request forgery (csrf)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

CVE-2018-10222

An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=articlecategory&do=save&frame=iPHP...

Microsoft Office: Show OneDrive Sign In

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013skydrivesignin.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Show OneDrive Sign In Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Cross site request forgery (csrf)

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-10096

joyplus-cms 1.6.0 has XSS via the devicename parameter in a manager/adminajax.php?action=save flag=add request...

CVE-2018-9924

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

CVE-2018-9925

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

Sql injection

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-08331)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in the save.php file in MetInfo version 6.0. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML...

tcpdump: Buffer overflow in util-print.c:bittok2str_internal()

A vulnerability was found in tcpdump's verbose printing of packet data. A crafted pcap file or specially crafted network traffic could cause tcpdump to write out of bounds in the BSS segment, potentially causing tcpdump to display truncated or incorrectly decoded fields or crash with a segmentati...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'pid' array parameter in the...

Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution

Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/ Software Link: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/...

Diggy - Extract Enpoints From APK Files

Diggy can extract endpoints/URLs from apk files. It saves the result into a txt file for further processing. Dependencies apktool Usage ./diggy.sh /path/to/apk/file.apk You can also install it for easier access by running install.sh After that, you will be able to run Diggy as follows: diggy...