CVE-2018-6363

Task Rabbit Clone 1.0 has a SQL injection in single_blog.php via the id parameter. The vulnerability (CVE-2018-6363) is documented with high/critical impact in CVSS metrics (C/H I/H A/H on networks, low attack complexity, no auth). Related references indicate public exploit activity (e.g., Packet...

CVE-2018-6363

SQL Injection exists in Task Rabbit Clone 1.0 via the singleblog.php id parameter...

PT-2018-17506

Name of the Vulnerable Software and Affected Versions Task Rabbit Clone version 1.0 Description The issue exists due to SQL Injection in the single blog.php file, specifically via the id parameter. Recommendations For Task Rabbit Clone version 1.0, consider restricting access to the single blog.p...

CVE-2018-6363: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in Task Rabbit Clone 1.0 via the singleblog.php id parameter...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation bsc1077291. - CVE-2018-5096: Use-after-free while editing form elements bsc1077291. - CVE-2018-5097:...

Task Rabbit Clone 1.0 - 'id' SQL Injection

Exploit Title: Task Rabbit Clone 1.0 - SQL Injection Dork: N/A Date: 27.01.2018 Vendor Homepage: http://migrateshop.com/ Software Link: http://migrateshop.com/product/task-rabbit-clone-php-script/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Sencan...

Task Rabbit Clone 1.0 SQL Injection

Exploit Title: Task Rabbit Clone 1.0 - SQL Injection Dork: N/A Date: 27.01.2018 Vendor Homepage: http://migrateshop.com/ Software Link: http://migrateshop.com/product/task-rabbit-clone-php-script/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: Ihsan Sencan...

OPENSUSE-SU-2018:0256-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation bsc1077291. - CVE-2018-5096: Use-after-free while editing form elements bsc1077291. - CVE-2018-5097:...

OPENSUSE-SU-2018:0257-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation bsc1077291. - CVE-2018-5096: Use-after-free while editing form elements bsc1077291. - CVE-2018-5097:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +52 more potentially affected by CVE-2018-1000015 via org.jenkins-ci.plugins.workflow:workflow-durable-task-step (>=0.1-beta-1, <=2.14)

org.jenkins-ci.plugins.workflow:workflow-durable-task-step MAVEN version =0.1-beta-1, =1.9.2-beta, =1.3.0, =0.1.18, =1.0-alpha-2, =1.0-alpha-2, =1.0-alpha-2, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-1, =1.0-alpha-2, =2.2.0, =2.2.1 and more Source cves: CVE-2018-1000015...

January 17, 2018—KB4057401 (Preview of Monthly Rollup)

None None...

Android - Hardware Service Manager Arbitrary Service Replacement due to getpidcon

This bug is similar to Jann Horn's issue https://bugs.chromium.org/p/project-zero/issues/detail?id=851 -- credit should go to him. The hardware service manager allows the registration of HAL services. These services are used by the vendor domain and other core processes, including systemserver,...

January 3, 2018—KB4056892 (OS Build 16299.192)

None None...

CHM Help Files Deliver Brazilian Banking Trojan

Security researchers are warning of a new spam campaign targeting Brazilian institutions that contain Compiled HTML file attachments that are used to deliver a banking Trojan. Spam messages contain a malicious CHM attachment called “comprovante.chm”, wrote Rodel Mendrez, senior security researche...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs...

CVE-2013-6465

Multiple cross-site scripting XSS vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs...

CVE-2013-6465

Multiple cross-site scripting XSS vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs...

CVE-2013-6465: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs...

PT-2017-5594

Name of the Vulnerable Software and Affected Versions: JBPM KIE Workbench versions 6.0.x Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task nam...

Open-Xchange: [IDOR] Deleting other people's tasks

Description When creating tasks each task is assigned with an id value. Using this id it's possible to delete any task created in the same instance even if you don't actually have access to viewing or editing the task. Steps to Reproduce 1 Login to https://sandbox.open-xchange.com/ with user1 2...