Arbitrary File Deletion Vulnerability in the 'hid_fname' Parameter of the OfficeTen Management System at Netstar Technology (Suzhou) Co.

OfficeTen Management System is an integrated information system that provides personalized services to customers. An arbitrary file deletion vulnerability exists in the 'hidfname' parameter of the OfficeTen Management System of NetEnt Technology Suzhou Co. Submit POST:...

Arbitrary File Read Vulnerability in VoIP Operation Support System of Kunshi Network Technology Co.

The VoIP operation support system of Kunshi Network Technology Co., Ltd. is a support system for small and medium-sized VoIP operation business. The product suffers from an arbitrary file read vulnerability, which can be exploited by an attacker to read sensitive files such as service...

Arbitrary File Download and Weak Password Vulnerability in DVR Access Gateway of Suzhou Kedar Technology Co.

DVR digital video recorder is a set of computer system for image storage and processing, with the function of long time video/voice recording, audio recording, remote monitoring and control. The DVR access gateway of Suzhou Kodak Technology Co., Ltd. suffers from arbitrary file download and weak...

Tor Joins Movement Against Expanding Hacking Powers

The Tor Project on Monday made a public plea for others to speak out against the proposed amendments to Rule 41 of the Federal Rules of Criminal Procedure, which are taking effect Dec. 1 barring a Congressional injunction. The amendments would expand the Department of Justice’s ability to hack...

Mobile APP vulnerabilities automated detection platform construction-vulnerability warning-the black bar safety net

Preface: this article is the mobile APP Client Security The notes of the series of original articles in the first article, mainly about enterprise mobile APP automated vulnerability detection platform construction, mobile APP vulnerability detection history with cutting-edge technology, the APP...

New Windows Patch Policy At Odds With Acceptable Risk

With Microsoft’s Patch Tuesday release tomorrow, the countdown begins for application developers to button down code ahead of Microsoft’s new servicing model starting in October that could present vulnerability issues for some businesses. “Tomorrow it’s going to be business as usual, but it will...

ZKTeco ZKAccess Security System 5.3.1 - stored XSS

Application description ZKAccess systems are built on flexible, open technology to provide management, real-time monitoring and control of your access control changes, access via a browser,without the need to install additional software. Security infrastructure devices centralized management,...

SQL Injection Vulnerability in iGENUS Mail System of Aegisys Technology (Chengdu) Co.

iGENUS mail system based on the Linux platform mail system comprehensive management, using a Web-based graphical management interface multifunctional system. The product exists exists SQL injection vulnerability, the vulnerability URL is: http://target/login.php?Cmd=error&Code=, the vulnerability...

Updated gnupg/libgcrypt packages fix security vulnerability

Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output CVE-2016-6313. The gnupg package has been...

ZKTeco ZKBioSecurity 3.0 - Cross-Site Request Forgery (Add Superadmin)

Exploit for jsp platform in category web applications !-- ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel:...

ZKTeco ZKBioSecurity 3.0 - Cross-Site Request Forgery (Add Superadmin)

!-- ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel: 1.0.1.0R1916 Access: 6.0.1.0R1757 Elevator: 2.0.1.0R777...

File Download Vulnerability in New Windward Technology's Online Learning Test System

New Windward Technology Online Learning Exam System is built based on enterprise-level database platform, the system architecture using a three-tier structure, B/S mode development can be used for online training and examination system. The product exists arbitrary file download vulnerability,...

SQL Injection Vulnerability in Asset Management System sysbh Parameter of Jinan Guozi Digital Technology Co.

Asset management system of Jinan Guozi Digital Technology Co., Ltd. is a set of sharing and management platform for precision instruments or large instruments. The product suffers from SQL injection vulnerability, the vulnerability URL is: http://host/dxyqsyspt/sysList.aspx?sysbh=000001 The...

SQL Injection Vulnerability in Gobetter Video Conferencing System of Beijing Gobetter Technology Co.

Gobalt network video conferencing system supports a variety of application scenarios such as work meetings, remote training, product sales, online seminars, consulting services and so on. There is a SQL injection vulnerability in the searchparam parameter of Gobetter videoconferencing system of...

SQL injection vulnerability in the login.php page of HAC operation and maintenance security audit system of Guangzhou Jiangnan Keyou Technology Co.

Jiangnan Keyou Operation and Maintenance Security Audit System HAC is used to solve critical IT infrastructure operation and maintenance security problems. It is capable of performing secure and effective operation audits on Unix and Windows hosts, servers, as well as data access on networks and...

Arbitrary File Containment Vulnerability in VoIP Operation Support System of Kunshi Network Technology Co.

The VoIP operation support system of Kunshi Network Technology Co., Ltd. is a support system for small and medium-sized VoIP operation business. The product suffers from an arbitrary file inclusion vulnerability, which can be exploited by an attacker to read sensitive files such as the service...

Weak Password Vulnerability in Tiandiweiye Digital Technology Easy7 Video Surveillance Platform

TDWI Easy7 video surveillance platform is a professional security management software for centralized cross-regional network video surveillance. A generic weak password vulnerability exists in Easy7 video surveillance platform. An attacker can exploit the vulnerability to log into the video...

SQL Injection Vulnerability in Channelcode Parameter of Hopping Synergy Content Management System

HZCMS is a website group content management system based on Java and XML technology. A SQL injection vulnerability exists in the channelcode parameter of the HZCMS. An attacker can exploit the vulnerability to obtain database information...

SQL Injection Vulnerability in Name Parameter of VoIP Operation Support System of Kunshi Network Technology Co.

The VoIP operation support system of Kunshi Network Technology Co., Ltd. is a support system for small and medium-sized VoIP operation business. A SQL injection vulnerability exists in the name parameter of the VoIP operation support system of Kunshi Network Technology Co. An attacker can exploit...

KV Site Admin CMS 3.0 SQL Injection

Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox skype:xbadgirl21 Video Proof :...