CS Money: IDOR in https://3d.cs.money/

Summary: Hello, I found an IDOR in https://3d.cs.money/ which will allow you to save, edit, delete build of victim account without any grant on the victim account Steps To Reproduce: This bug based on steamID which is reflected on Steam or you can use any Steam ID Finder software to find...

Cross site request forgery (csrf)

WampServer before 3.1.9 has CSRF in addvhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner...

F5 Networks BIG-IP : Oracle Java SE vulnerability (K44923228)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedded: 8u152; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with...

Integer overflow

The mintToken function of a smart contract implementation for SpeedCashLite SCSL, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2017-8050

Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...

Bzrtp Man-in-the-middle Spoofing Vulnerability

bzrtp is an open source ZRTP key exchange protocol. Bzrtp suffers from a man-in-the-middle spoofing vulnerability. An attacker can exploit the vulnerability to conduct spoofing attacks and perform unauthorized manipulation...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2016-09908)

Oracle MySQL is an open source relational database management system from Oracle. This database system is characterized by high performance, low cost and good reliability. A security vulnerability exists in a subcomponent of Oracle MySQL Server:MyISAM, which can be exploited by attackers to...

Joomla Component com_caddy - Vulnerability

No description provided by source. Exploit Title: Vulnerability in Joomla Component comcaddy Date: 2010-04-22 Author: SuBz3r0 Software Link: Joomla Component: comcaddy Tested on: CVE : if exists Code : Just use for example the firefox addon tamper data while adding a product to the cart. Then loo...

Oracle Database SQL Compiler Views Unauthorized Manipulation

No description provided by source. source: http://www.securityfocus.com/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well. The...

Easy Enterprise DMS Cross Site Scripting / Unauthorized Access

------------------------------------------------ Multiple Vulnerabilities in EASY Enterprise DMS - Stored XSS - XSS - Content Injection / Phishing through Frames - Unauthorized access to files - Unauthorized manipulation of data Date: 25.03.2010 ------------------------------------------------ EA...

otrs -- SQL injection

OTRS Security Advisory reports: Missing security quoting for SQL statements allows agents and customers to manipulate SQL queries. So it's possible for authenticated users to inject SQL queries via string manipulation of statements. A malicious user may be able to manipulate SQL queries to read o...

FaScript FaUpload (download.php) SQL Injection Vulnerability

No description provided by source. !!..:: ZAC003 ::..!! -+ Vive int Iranian WhiteHat Nomads Group +- ------------------------------------------------------------------------------------------- Reporter : ZAC003 From Aria-Security.Net Script Download :...

TlAds v1 Remote Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ====================================================== TlAds v1 Remote Insecure Cookie Handling Vulnerability ====================================================== TlAds v 1 = Insecure Cookie Handling Found By : x0r - Evolution Team...

Oracle Database - SQL Compiler Views Unauthorized Manipulation

Oracle Database - SQL Compiler Views Unauthorized Manipulation source: https://www.securityfocus.com/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected...

Oracle Database - SQL Compiler Views Unauthorized Manipulation

source: https://www.securityfocus.com/bid/24887/info Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well. The issues identified by the vendor...

ColdFusion Multiple Vulnerabilities (File Upload/Manipulation)

The 'exprcalc.cfm' page in the version of Cold Fusion Application Server running on the remote host allows an unauthenticated, remote attacker to read arbitrary files and possibly delete or upload arbitrary files as well. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...