Multiple loopholes in the online marking system of Beijing Wuyuexin Information Technology Co.

Xin e evaluation campus version of the online marking system is Beijing Wuyue Xin company customized for the school, to create a campus-level online marking software and hardware solutions. Beijing Wuyuexin Information Technology Co., Ltd. Xin e online marking system exists overstepping the right...

Updated freerdp packages fix security vulnerabilities

An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle...

Conarc iChannel - Improper Access Restrictions Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of server Date: 2017-12-19 Exploit Author: Information Paradox CVE : CVE-2017-17759...

BEIMS ContractorWeb 5.18.0.0 - SQL Injection Vulnerability

Exploit for windows platform in category web applications Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0...

BEIMS ContractorWeb 5.18.0.0 SQL Injection

Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0 CVE : 2017-17721 Vulnerability Details:...

Conarc iChannel - Improper Access Restrictions

Conarc iChannel - Improper Access Restrictions Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of server Date: 2017-12-19 Exploit Author: Information Paradox CVE : CVE-2017-17759 https://affectedserver/wc.dll?wwMaintEditConfig The...

BEIMS ContractorWeb 5.18.0.0 - SQL Injection

BEIMS ContractorWeb 5.18.0.0 - SQL Injection Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0 CVE :...

Conarc iChannel - Improper Access Restrictions

Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of server Date: 2017-12-19 Exploit Author: Information Paradox CVE : CVE-2017-17759 https://affectedserver/wc.dll?wwMaintEditConfig The customized webserver used by iChannel is based o...

BEIMS ContractorWeb 5.18.0.0 - SQL Injection

Exploit Title: SQL Injection Date: 18 December, 2017 Exploit Author: Rajwinder Singh Vendor Homepage: http://www.beims.com/products/ Software Link: http://www.beims.com/optional-modules/ccw Version: BEIMS ContractorWeb .NET System 5.18.0.0 CVE : 2017-17721 Vulnerability Details:...

VulnCheck KEV: CVE-2017-7494

Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it...

OS Command Injection & Reflected Cross Site Scripting in OpenEMR

Vendor description: ------------------- "OpenEMR is the most popular open source electronic health records and medical practice management solution. ONC certified with international usage, OpenEMR's goal is a superior alternative to its proprietary counterparts." Source: http://www.open-emr.org/...

InvoicePlane Arbitrary File Upload Vulnerability

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. An arbitrary file upload vulnerability exists in InvoicePlane version 1.4.10. An attacker could exploit this vulnerability to upload a malicious file to the web server or possibly...

Server heap memory information leak.

Description All versions of Samba from 3.6.0 onwards are vulnerable to a heap memory information leak, where server allocated heap memory may be returned to the client without being cleared. There is no known vulnerability associated with this error, but uncleared heap memory may contain previous...

CVE-2017-1000235

I, Librarian version =4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised...

October CMS PHP Code Execution Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. A PHP code execution vulnerability exists in the Asset Manager feature of October CMS build 412. An attacker can exploit this vulnerability to compromise a website and other applications on the server...

I, Librarian OS Command Injection Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. An operating system command injection vulnerability exists in the batchimport.php file in Scilico I, Librarian versions 4.6 and earlier and 4.7. An attacker can exploit the vulnerability to...

October CMS Apache Configuration Modification Vulnerability

OctoberCMS is a CMS system based on Laravel PHP development framework. October CMS build 412 suffers from an Apache configuration modification vulnerability. The vulnerability can be exploited to compromise a website and other applications on the server via the file upload feature...

Code execution vulnerability in Axublog ad/theme.php file

Axublog is a PHP personal blog system. A code execution vulnerability exists in the Axublog ad/theme.php file. The vulnerability is due to the program failing to filter the parameters passed, an attacker can exploit the vulnerability to construct a specially crafted file, upload a shell, and obta...

Code Execution Vulnerability in Shanghai Esaote IPOS Terminal Management System

Shanghai Esaote iPOS Terminal Management System is a professional retail terminal solution for large and medium-sized fashion enterprises in footwear, sports, furniture, daily chemicals, beauty, jewelry, food and so on. A code execution vulnerability exists in the Shanghai Esaote iPOS Terminal...

jQuery Official Blog Hacked — Stay Calm, Library is Safe!

The official blog of jQuery—most popular JavaScript library used by millions of websites—has been hacked by some unknown hackers, using the pseudonym "str0ng" and "n3tr1x." jQuery's blog website blog.jquery.com runs on WordPress—the world's most popular content management system CMS used by...