Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi Cross-Site Scripting Vulnerability

Hotspot Express hotEx Billing Manager is a billing management system. A cross-site scripting vulnerability in Hotspot Express hotEx Billing Manager cgi-bin/hotspotlogin.cgi allows attackers to submit special reply parameters to inject malicious HTML or scripts and obtain sensitive information...

Inductive Automation Ignition Information Disclosure Vulnerability (CNVD-2015-02154)

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Inductive Automation Ignition suffers from an information disclosure vulnerability that could be exploited by an attacker to gain access to sensitive information...

EMC M&R (Watch4net) < 6.5u1 Multiple Vulnerabilities

EMC M&R Watch4net is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:emc:watch4net"; if...

SQL Injection Vulnerability in VOLANS SR Internet Behavior Audit Gateway of Chengdu Flying Fish Star Technology Co.

VOLANS SR Internet Behavior Audit Gateway of Chengdu Flyingfish Star Technology Co., Ltd. is designed for small and medium-sized enterprises, providing perfect Internet behavior management, intelligent bandwidth management and multi-line load balancing solutions. SQL injection vulnerability exist...

SQL Injection Vulnerability in Hotel Online Direct Marketing Platform of Guangzhou Askway Information Technology Co.

Ltd. is a set of hotel online direct marketing technology and operation service system, focusing on building their own online direct marketing platform and system for hotels, providing consulting, advisory, training and other services to help hotels to improve the operation and revenue capacity...

CVE-2014-8161

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message...

YourMembers Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin Vendor: YourMembers plugin Product: https://github.com/YourMembers/yourmembers/tree/master/ymtrunk Affected version: Version 3, 29 June 2007...

CVE-2014-5269

Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static...

Shop7z多个漏洞大礼包

简要描述： 前台存储型XSS打后台，后台限制不严导致敏感数据访问，自己给自己充值TAT，等等···· 详细说明： 0x01 前台XSS，使用官方最新的免费版源代码 在注册用户的时候，地址当中输入XSS代码 " 如图 然后注册，显示注册成功 这时候查看一下后台---会员信息管理--会员管理---该会员详细信息 可以看到xss代码已经插进去了 而xss平台也能收到cookies信息 0x02 未授权访问 http://127.0.0.1/admin/huiyuandetail.asp?id=831 该地址在免费版中未做权限检查，导致可以直接在这里遍历会员信息，同时可以修改任意会员信息 相关代...

CA eSCC r8/1.0,eTrust Audit r8/1.5 Audit Event System Unspecified Replay Attack

No description provided by source. source: http://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a replay issue. These...

AnnonceScriptHP 2.0 admin/admin_config/Aide.php email Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/21514/info AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these...

Cisco Video Surveillance Manager Multiple Vulnerabilities (cisco-sa-20130724-vsm)

According to its self-reported version, the version of Cisco Video Surveillance Manager installed on the remote host is affected by multiple vulnerabilities : - The application is affected by a directory traversal vulnerability because Cisco VSM does not properly validate user-supplied input to t...

Svlink SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2012-4008

The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site...

Scientific Linux Security Update : firefox on SL5.x, SL4.x, SL3.x i386/x86_64

Several flaws were found in the way Firefox processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. CVE-2007-2867, CVE-2007-2868 A flaw was found in the way Firefox...

AzDGDatingMedium 1.9.3 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/53692/info AzDGDatingMedium is prone to multiple remote vulnerabilities that includes a SQL-injection vulnerability, an information-disclosure vulnerability, a directory-traversal vulnerability and multiple cross-site scripting vulnerabilities, Exploiting...

Cotonti <=0.9.2 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CORE-2010-1118: Oracle GlassFish Server Administration Console Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ Oracle GlassFish Server Administration Console Authentication Bypass 1. Advisory Information Title: Oracle GlassFish Server Administration Console Authentication Bypass...

HTB22967: Multiple SQL Injection in Shutter

Vulnerability ID: HTB22967 Reference: http://www.htbridge.ch/advisory/sqlinjectioninshutter.html Product: Shutter Vendor: http://shutter.tenfourzero.net/ http://shutter.tenfourzero.net/ Vulnerable Version: 0.1.4 Vendor Notification: 19 April 2011 Vulnerability Type: SQL Injection Risk level: High...

Firefox < 3.5.19 Multiple Vulnerabilities

The installed version of Firefox is earlier than 3.5.19. Such versions are potentially affected by the following security issues : - Multiple use-after-free errors exist in the handling of the object attributes 'mChannel', 'mObserverList' and 'nsTreeRange'. CVE-2011-0065, CVE-2011-0066,...