CVE-2019-3587 DLL Search Order Hijacking vulnerability

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection MTP Prior to 16.0.18 allows local users to execute arbitrary code via execution from a compromised folder...

TotalComfortSolutions Company 1.0 SQL Injection

Exploit Title : TotalComfortSolutions Company 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Vendor Homepages : totalcomfortsolutions.com Tested On : Windows and Linux Exploit Risk : Medium Category : WebApps Version Information : jQuery 1.4.11 - CodeIgniter -...

WordPress Total-Child-Theme-Master Themes Arbitrary File Download Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in WordPress Total-Child-Theme-Master Themes. An attacker can exploit the...

total-apps.net XSS vulnerability

Open Bug Bounty ID: OBB-710909 Description| Value ---|--- Affected Website:| total-apps.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

WordPress Total-Child-Theme-Master 1.0 Arbitrary File Disclosure

Exploit Title : WordPress Total-Child-Theme-Master Themes 1.0 Arbitrary File Download Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org wpexplorer-themes.com/total/docs/child-theme/ Software Download Link :...

total-apps.net XSS vulnerability

Open Bug Bounty ID: OBB-698942 Description| Value ---|--- Affected Website:| total-apps.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-18603

360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system"CMD" or os.system"PowerShell", within a .py file. NOTE: the vendor's position is that this cannot be categorized as a vulnerability, although it is a security-related issue...

CVE-2018-18603

360 Total Security 3.5.0.1033 is associated with CVE-2018-18603, which describes a sandbox escape via an import os statement followed by os.system("CMD") or os.system("PowerShell") inside a Python file. The root issue is the sandbox permitting shell execution from within a Python file, enabling p...

CVE-2018-18603

360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system"CMD" or os.system"PowerShell", within a .py file. NOTE: the vendor's position is that this cannot be categorized as a vulnerability, although it is a security-related issue...

PT-2018-14540 · Qihoo 360 · 360 Total Security

Name of the Vulnerable Software and Affected Versions: 360 Total Security version 3.5.0.1033 Description: The issue allows a Sandbox Escape via an import os statement, followed by os.system"CMD" or os.system"PowerShell", within a .py file. The vendor considers this a security-related issue but do...

SubScraper - External Pentest Tool That Performs Subdomain Enumeration Through Various Techniques

SubScraper uses DNS brute force, Google & Bing scraping, and Virus Total to enumerate subdomains without an API. Written in Python3, SubScraper performs HTTPS requests and DNS "A" record lookups during the enumeration process to validate discovered subdomains. This provides further information to...

Fedora 27 : mozilla-noscript (2018-09c51bbcec)

Changes since 10.1.8.16: === v 10.1.9.6 ============================================================= - TB Gracefully handle legacy external message recipients - XSS Updated known HTML5 events - Better IPV6 support - UI support for protocol-only entries v 10.1.9.5...

Cross site scripting

In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader-MaxPtCnt' and which could result in OO...

CVE-2018-16157

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=cart&a=save itemtotals parameter to zero, the entire cart is sold for free...

Quick Heal Total Security DLL Hijacking Vulnerability

Quick Heal Total Security is prone to a DLL hijacking vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-8090

Quick Heal Total Security 64 bit 17.00 QHTS64.exe, QHTSFT64.exe - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 QHTS32.exe, QHTSFT32.exe - Version 10.0.1.38; Quick Heal Internet Security 64 bit 17.00 QHIS64.exe, QHISFT64.exe - Version 10.0.0.37; Quick Heal Internet Security 32 bit 17....

CVE-2018-8090

Quick Heal Total Security 64 bit 17.00 QHTS64.exe, QHTSFT64.exe - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 QHTS32.exe, QHTSFT32.exe - Version 10.0.1.38; Quick Heal Internet Security 64 bit 17.00 QHIS64.exe, QHISFT64.exe - Version 10.0.0.37; Quick Heal Internet Security 32 bit 17....

CVE-2018-8090

Quick Heal Total Security 64 bit 17.00 QHTS64.exe, QHTSFT64.exe - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 QHTS32.exe, QHTSFT32.exe - Version 10.0.1.38; Quick Heal Internet Security 64 bit 17.00 QHIS64.exe, QHISFT64.exe - Version 10.0.0.37; Quick Heal Internet Security 32 bit 17....

CVE-2018-5384

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available...

Sql injection

Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available...