PT-2014-5646

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.3.21 Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. Recommendations For versions prior to 2.3.21, update to...

Mail.ru: XXE and SSRF on webmaster.mail.ru

SSRF request: POST /domain/metadata HTTP/1.1 Host: webmaster.mail.ru User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:29.0 Gecko/20100101 Firefox/29.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate...

PT-2014-2022 · Oracle +10 · Mysql Server +9

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.32 and prior MySQL Server versions 8.0.22 and prior Description: The issue exists due to insufficient input validation in the Information Schema component of MySQL Server. This allows a remote attacker to gain...

PT-2014-2736

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 8.x through 8.5 FP3 IBM InfoSphere Information Server versions 8.7.x through 8.7 FP2 IBM InfoSphere Information Server versions 9.1.x through 9.1.2.0 Description The issue allows remote authenticated...

PT-2014-3277

Name of the Vulnerable Software and Affected Versions Avanset Visual CertExam Manager versions 3.3 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands via the Title, File name, or Candidate Name field, potentially leading to unauthorized data acce...

Ecmall 2. x version exist through the kill SQL injection vulnerability-vulnerability warning-the black bar safety net

Brief description: Originally wanted to complete analysis and then struggle ECSHOP...the result has not been to old cassock opportunity to Ah,more and more can't believe is not the official version,is not under the wrong. Drink more the head a little dizzy. I don't know if the analysis is written...

Z-Blog php Edition front regular SQL blind injection vulnerability-vulnerability warning-the black bar safety net

Brief description: The second...also a bit puzzled want to ask your developer Detailed description: The problem /zbsystem/function/csystemcommon.php function GetVars$name,$type='REQUEST' if $type=='ENV' $array=&$ENV; if $type=='GET' $array=&$GET; if $type=='POST' $array=&$POST; if $type=='COOKIE'...

PT-2013-5523

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator version 5.2 IBM Sterling File Gateway version 2.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification...

CVE-2013-4604: Undefined Security Weakness

Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role...

PT-2012-6274 · Carlo Gavazzi · Eos-Box

Name of the Vulnerable Software and Affected Versions: Carlo Gavazzi EOS-Box versions prior to 1.0.0.1080 2.1.10 Description: The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. This is achieved through SQL injectio...

PT-2012-5675

Name of the Vulnerable Software and Affected Versions Agile FleetCommander versions prior to 4.08 Agile FleetCommander Kiosk versions prior to 4.08 Description The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification...

PT-2012-2820

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1 through 7.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be done via unspecified vectors, potentially leading to unauthorized data access or...

Solaris 10 (x86) : 141105-04 (deprecated)

Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Solaris Management Console. The supported version that is affected is 10. Difficult to exploit vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can...

PT-2012-1230

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 10.1.3.5 Description The issue is related to insufficient protection of service data in the Designer subcomponent of the Oracle WebCenter Forms Recognition component. This can be exploited by a remote attacker ...

PT-2012-1899

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary SQL commands via crafted string input, potentially leading to unauthorized data access or modification. Recommendations For...

PT-2012-2435

Name of the Vulnerable Software and Affected Versions Advantech/BroadWin WebAccess versions prior to 7.0 Description The issue allows remote attackers to execute arbitrary SQL commands via crafted string input, potentially leading to unauthorized data access or modification. Recommendations For...

PT-2011-4394

Name of the Vulnerable Software and Affected Versions ATCOM Netvolution version 2.5.8 Description The issue allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header, potentially leading to unauthorized data access or modification. Recommendations For ATCOM Netvolution...

CVE-2010-2787

api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim...

SA00001-2010

Vulnerability Report 1. Affected software OrangeHRM 2.5.0.4 Prior versions may also be affected. "OrangeHRM is an Open Source HRM system. It provides an ideal solution for small and medium sized enterprises looking for an inexpensive way to effectively manage and develop their human resources."...

Mozilla Firefox 3.6 window.location对象非授权数据访问漏洞

CVE ID: CVE-2010-0170 Firefox是一款流行的开源WEB浏览器。 由于开发了新的机制来强制窗口与帧之间的同源策略，Firefox 3.6的浏览器引擎将window.location对象更改为正常的可覆盖JavaScript对象。但一些插件也使用这个对象判断页面来源以实施访问限制，因此恶意网页可以通过覆盖这个对象欺骗插件允许到其他站点或本地文件系统上数据的访问。 Mozilla Firefox 3.6 厂商补丁： Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mozilla.org/...