Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx Vendor: ================ www.mantisbt.org Product: ========= Mantis Bug Tracker 1.3.10 / v2.3.0 MantisBT is a popular free web-based bug tracking system. It is written in PHP works with MySQL, MS SQL, and...

Mantis Bug Tracker 1.3.102.3.0 - Cross-Site Request Forgery

Mantis Bug Tracker 1.3.102.3.0 - Cross-Site Request Forgery + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org...

Mantis Bug Tracker 1.3.10/2.3.0 - Cross-Site Request Forgery

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-CSRF-PERMALINK-INJECTION.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org Product: ========= Mantis Bug Tracker 1.3.10 / v2.3.0 MantisBT...

Mantis Bug Tracker verify.php confirm_hash Remote Password Reset (CVE-2017-7615)

A remote password reset vulnerability exists in Mantis Bug Tracker. The vulnerability is due to a lack of input validation on the confirmhash parameter when verifying password reset requests. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to th...

Everyday Health Diabetes in Check:Blood Glucose&Carb Tracker app for iOS Sensitive Information Disclosure Vulnerability

The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app for iOS is a mobile application for monitoring and managing the health of diabetic patients for iOS from Everyday Health, Inc. A sensitive information disclosure vulnerability exists in Everyday Health Diabetes in Check: Bloo...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original researcher...

Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. PoC Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original...

Spending Tracker - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Spending Tracker published at the 'play' market has multiple vulnerabilities...

Wallet - Budget Tracker - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Wallet - Budget Tracker published at the 'play' market has multiple vulnerabilities...

Zenmoney: expense tracker - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Zenmoney: expense tracker published at the 'play' market has multiple vulnerabilities...

Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset Exploit

Exploit for php platform in category web applications + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org...

Mantis Bug Tracker 1.3.02.3.0 - Password Reset

Mantis Bug Tracker 1.3.02.3.0 - Password Reset + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org Product...

Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt + ISR: ApparitionSec Vendor: ================ www.mantisbt.org Product: ================== Mantis Bug Tracker v1.3.0 /...

Gazelle cross-site scripting vulnerability (CNVD-2017-05135)

Gazelle is a set of web frameworks for BitTorrent trackers. A cross-site scripting vulnerability exists in versions of Gazelle prior to 2017-03-19 that stems from the program failing to adequately filter the torrents and size parameters. A remote attacker could use this vulnerability to execute...

Harvest Time & Expense Tracker - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Harvest Time & Expense Tracker published at the 'play' market has multiple vulnerabilities...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-04628)

MantisBT is an open-source issue management system developed in PHP and commonly used for internal collaboration within corporate teams. A cross-site scripting vulnerability exists in the moveattachmentspage.php page in MantisBT 1.2.16 and later versions, which can be exploited to inject script o...

Eview EV-07S GPS Tracker Security Bypass Vulnerability

The Eview EV-07S GPS Tracker is a GPS tracking device for personal safety and personal protection. A security vulnerability exists in the phone number of the Eview EV-07S GPS Tracker, which originates from a lack of authentication in the program. The vulnerability can be exploited to restore the...

Eview EV-07S GPS Tracker Information Disclosure Vulnerability

The Eview EV-07S GPS Tracker is a GPS tracking device for personal safety and personal protection. A security vulnerability exists in the Eview EV-07S GPS Tracker. The vulnerability can be exploited by an attacker to obtain sensitive information GPS data, etc...

Gazelle cross-site scripting vulnerability (CNVD-2017-05628)

Gazelle is a set of web frameworks for BitTorrent trackers. A cross-site scripting vulnerability exists in versions of Gazelle prior to 2017-03-19. A remote attacker can exploit the vulnerability to execute arbitrary HTML and script...

CVE-2017-5237

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"...