CVE-2017-3345

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via...

Code injection

Vulnerability in the Automatic Service Request ASR component of Oracle Support Tools subcomponent: ASR Manager. The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Reque...

WordPress Plugin Firewall 2 1.3 - Cross-Site Request Forgery Cross-Site Scripting

WordPress Plugin Firewall 2 1.3 - Cross-Site Request Forgery Cross-Site Scripting alert1" !-- In a real attack, forms can be submitted automatically and spear-phishing attacks can be convincing. Mitigations ================ Disable the plugin until a new version is released that fixes this bug...

CVE-2016-8795

Huawei CloudEngine 12800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 5800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 6800 with software V100R002C00, V100R003C00, V100R003C10,...

CVE-2017-7240

An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information t...

SUSE-SU-2017:0392-1 Security update for spice

This security update for spice fixes the following issues: CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. bsc1023078 CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a...

Design/Logic Flaw

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with...

Mattermost Cross-Site Scripting Vulnerability

Mattermost is an open source alternative to Slack.Developed in the Go language, Mattermost is an open source team communication service. Mattermost suffers from a cross-site scripting vulnerability that can be exploited by unauthenticated attackers to trigger cross-site attacks...

Huawei Flybox B660 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Document Title: =============== Huawei Flybox B660 - POST Reboot CSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2025 Release Date: ============= 2017-01-10 Vulnerability...

Responsive Poll 1.6.4 / 1.7.4 CSRF / Cross Site Scripting

Details ================ Software: Responsive Poll Version: 1.6.4,1.7.4 Homepage: http://codecanyon.net/item/responsive-poll/6785692 Advisory report: https://security.dxw.com/advisories/csrfxss-in-responsive-poll-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/ CVE: Awaiting...

WordPress Plugin Quiz And Survey Master 4.5.4/4.7.8 - Cross-Site Request Forgery

alert1” in the questionname field then “question: ‘alert1’,” will get output inside the JS object. All good so far. However, in js/adminquestion.js on line 205, we see this line, as part of some JS-generated HTML: jQuery''.htmlquestionslisti.question.replace/"/g, '"'.replace/'/g,...

WordPress Quiz And Survey Master 4.7.8 / 4.5.4 XSS / CSRF

Details ================ Software: Quiz And Survey Master Formerly Quiz Master Next Version: 4.5.4,4.7.8 Homepage: https://wordpress.org/plugins/quiz-master-next/ Advisory report:...

WordPress Plugin Quiz And Survey Master 4.5.44.7.8 - Cross-Site Request Forgery

WordPress Plugin Quiz And Survey Master 4.5.44.7.8 - Cross-Site Request Forgery alert1” in the questionname field then “question: ‘alert1’,” will get output inside the JS object. All good so far. However, in js/adminquestion.js on line 205, we see this line, as part of some JS-generated HTML:...

Access restriction bypass to delete DBM files in Cybozu Dezie

Overview Cybozu Dezie provided by Cybozu,Inc. contains an access restriction bypass vulnerability to delete DBM Cybozu Dezie proprietary format files. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under th...

Piwik <= 2.16.0 (saveLayout) PHP object injection vulnerability

The vulnerability can be triggered through the saveLayout method defined in /plugins/Dashboard/Controller.php: 210. public function saveLayout 211. 212. $this-checkTokenInUrl; 213. 214. $layout = Common::unsanitizeInputValueCommon::getRequestVar'layout'; 215. $layout = striptags$layout; 216...

Unauthorized Access Vulnerability in Goodview Video Conferencing System

GoodVision video conferencing system, supports mobile phone/tablet/PC HD video conferencing. An unauthorized access vulnerability exists in the GoodVision video conferencing system. An unlogged-in attacker can exploit the vulnerability to backup or download system database files...

CVE-2016-6357

A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. More Information:...

Cisco AsyncOS Denial of Service Vulnerability (CNVD-2016-10394)

The Cisco AsyncOS operating system is available to enhance the security and performance of Cisco email security appliances. A remote denial of service vulnerability exists in Cisco AsyncOS, which can be exploited by an unauthenticated, remote attacker to cause a denial of service condition...

RSS News AutoPilot Script 1.0.13.1.0 - Admin Panel Authentication Bypass

RSS News AutoPilot Script 1.0.13.1.0 - Admin Panel Authentication Bypass Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link:...

RSS News AutoPilot Script 1.0.1/3.1.0 - Admin Panel Authentication Bypass

Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898 Version: 1.0.1 to 3.1.0...