Election Readiness 2018

2018 is a pivotal year for the integrity of our electoral process. The threat to the digital infrastructure of our elections is proliferating to a level that has not been seen before. Officials are working tirelessly to protect your vote by proactively identifying vulnerabilities and targeting...

SAP BC-SRV-ALV Authentication Bypass Vulnerability

SAP BC-SRV-ALV is a flexible tool for displaying lists that provides basic functionality for list manipulation and can also be enhanced with customization for use in large applications. An authentication bypass vulnerability exists in SAP BC-SRV-ALV. An attacker could use this vulnerability to ga...

Cloud EC e-commerce system SQL injection vulnerability in the foreground

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the frontend. Attackers can use the...

CVE-2018-0278

A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensitive data about the system. The vulnerability is due to improper cross-origin domain protections for the WebSocket protocol. An attacker could exploit this...

RATELIMITED: Local File Download

Summary: This bug affects suuport.ratelimited.me and can be used by attackers to download local file from your servers including your emails, and files uploaded by your admins and other users. Description: While starting a conversation with your support agent, I noticed an option to upload a file...

CVE-2018-10522

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

Uber: Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg

lioncityrentals.com.sg employed a Wordpress installation that possessed a vulnerable plugin, Formidable Forms, which was vulnerable to reflected XSS, and exposed sensitive form data. Thanks again for the report, @healdb! This was the first bug I ever found that exposed a large amount of PII, than...

SQL Injection Vulnerability in Enterprise Website Building System of Zaozhuang Frontier Technology Co.

Zaozhuang Frontier Technology Co., Ltd. is engaged in software technology services. A SQL injection vulnerability exists in the enterprise website building system of Zaozhuang Frontier Technology Co. An attacker can exploit the vulnerability to obtain sensitive database information...

Cleartext Transmission of Sensitive Information via HTTP

The host / application transmits sensitive information username, passwords in cleartext via HTTP. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2017-1524

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request that could be used to aid future attacks. IBM X-Force ID: 129970...

CVE-2017-0934

Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator read-only account could escalate privileges to admin...

CVE-2017-0935

Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator read-only account could escalate privileges to admi...

NiuShop B2C Single Merchant Mall System suffers from SQL Injection Vulnerability

NiuShop B2C single merchant mall system is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NiuShop B2C single merchant mall system SQl injection vulnerability, attackers can use the vulnerability to obtain sensitive...

SQL Injection Vulnerability in Vanguard Digitizing System

Vanguard Digital Technology Inc. provides web animation, graphic visual design, online advertising and marketing, and multimedia CD-ROM production services. A SQL injection vulnerability exists in the Vanguard Digital Web Building System. An attacker can exploit the vulnerability to obtain...

SQL Injection Vulnerability in Frontend of gxlcmsqy System

GxlcmsQY system is a simple program tailored for business users. A SQL injection vulnerability exists in the frontend of the gxlcmsqy system. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Website Building System of Tianjin Qixiang Technology Co.

Tianjin Enterprise Xiang Technology Co., Ltd. is a collection of network technology services and enterprise e-commerce and communication network services as one of the technology-based enterprises. Specializing in Baidu bidding, Baidu promotion, website construction, seo optimization, 400...

Wenzhou Qiaoyu Technology Co., Ltd. station building system SQL injection vulnerability

Wenzhou Qiaoyu Technology Co., Ltd. is a focus on high-quality website construction, micro-site development, network marketing services SEO optimization as one of the innovative level of the company. Wenzhou Qiaoyu Technology Co., Ltd. website building system SQL injection vulnerability, attacker...

XVNA - Extreme Vulnerable Node Application

XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting this application in native setting and...

CVE-2018-8712

An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data...