WordPress Plugin WP Symposium 15.1 - Blind SQL Injection

Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report: https://security.dxw.com/advisories/blind-sql-injection-in-wp-symposium-allows-unauthenticated-attackers-to-access-sensitive-data/ CVE: Awaiting assignment CVSS: 6.4...

Microsoft Windows Kernel 'Win32k.sys' Information Disclosure Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. An information disclosure leak exists in the Microsoft Windows Kernel 'Win32k.sys'. A local attacker can exploit the vulnerability to obtain sensitive information, bypass certain security restrictions and perform unauthorized...

CollabNet Subversion Edge Security Bypass Vulnerability

CollabNet Subversion Edge is a free web-based and cloud-based Subversion platform. A security vulnerability exists in CollabNet Subversion Edge that could be exploited by an attacker to perform unauthorized actions, obtain sensitive information, and elevate privileges...

SQL Injection Vulnerability in the Page Parameters of Nanjing Jenohan Journal Submission System

Nanjing Jenohan Software Technology Co., Ltd. is for the development of hospital full cost accounting decision support software system, hospital performance management information system and hospital customer management information system. SQL injection vulnerability exists in the page parameter ...

WebCC Remote Video Surveillance System Exploits Violent Breach Vulnerability

WebCC remote video surveillance system is a video surveillance system of Jinan Zhongwei Century Technology Co. Zhongwei WebCC remote video surveillance system has a brute-force cracking vulnerability. Comprehensive use of the vulnerability, the attacker can use the vulnerability to blast the user...

SQL Injection Vulnerability in Mobile OPAC Library Portal System of Huifen Software

Ltd.'s Mobile Library Portal System is a mobile service solution integrating Pocket Portal and Pocket APP, which brings readers and libraries closer together in the era of mobile intelligence. SQL injection vulnerability in Huiwen Software Mobile OPAC Library Portal System. Allows an attacker to...

Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi Cross-Site Scripting Vulnerability

Hotspot Express hotEx Billing Manager is a billing management system. A cross-site scripting vulnerability in Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi allows attackers to submit special reply parameters to inject malicious HTML or scripts and obtain sensitive information...

Inductive Automation Ignition Information Disclosure Vulnerability (CNVD-2015-02154)

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Inductive Automation Ignition suffers from an information disclosure vulnerability that could be exploited by an attacker to gain access to sensitive information...

EMC M&R (Watch4net) < 6.5u1 Multiple Vulnerabilities

EMC M&R Watch4net is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:emc:watch4net"; if...

SQL Injection Vulnerability in VOLANS SR Internet Behavior Audit Gateway of Chengdu Flying Fish Star Technology Co.

VOLANS SR Internet Behavior Audit Gateway of Chengdu Flyingfish Star Technology Co., Ltd. is designed for small and medium-sized enterprises, providing perfect Internet behavior management, intelligent bandwidth management and multi-line load balancing solutions. SQL injection vulnerability exist...

SQL Injection Vulnerability in Hotel Online Direct Marketing Platform of Guangzhou Askway Information Technology Co.

Ltd. is a set of hotel online direct marketing technology and operation service system, focusing on building their own online direct marketing platform and system for hotels, providing consulting, advisory, training and other services to help hotels to improve the operation and revenue capacity...

CVE-2014-8161

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message...

YourMembers Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...

CVE-2014-5269

Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static...

Shop7z多个漏洞大礼包

简要描述： 前台存储型XSS打后台，后台限制不严导致敏感数据访问，自己给自己充值TAT，等等···· 详细说明： 0x01 前台XSS，使用官方最新的免费版源代码 在注册用户的时候，地址当中输入XSS代码 " 如图 然后注册，显示注册成功 这时候查看一下后台---会员信息管理--会员管理---该会员详细信息 可以看到xss代码已经插进去了 而xss平台也能收到cookies信息 0x02 未授权访问 http://127.0.0.1/admin/huiyuandetail.asp?id=831 该地址在免费版中未做权限检查，导致可以直接在这里遍历会员信息，同时可以修改任意会员信息 相关代...

CA eSCC r8/1.0,eTrust Audit r8/1.5 Audit Event System Unspecified Replay Attack

No description provided by source. source: http://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a replay issue. These...

AnnonceScriptHP 2.0 admin/admin_config/Aide.php email Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21514/info AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these...

Cisco Video Surveillance Manager Multiple Vulnerabilities (cisco-sa-20130724-vsm)

According to its self-reported version, the version of Cisco Video Surveillance Manager installed on the remote host is affected by multiple vulnerabilities : - The application is affected by a directory traversal vulnerability because Cisco VSM does not properly validate user-supplied input to t...

Svlink SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2012-4008

The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site...