Sakh.biz - Corrupted files, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Sakh.biz published at the 'play' market has multiple vulnerabilities...

Taxi.Sakh.com - External URLs, Unsafe deleting, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Taxi.Sakh.com published at the 'play' market has multiple vulnerabilities...

Jtbccms V1.0 'jtbc_cms_admin_manage_delete_filedisp()' function has a file deletion vulnerability

Jtbccms is a website system that can expand and clone existing modules. Jtbccms version 1.0 'jtbccmsadminmanagedeletefiledisp' function has a file deletion vulnerability. Due to receiving filepath variable to do iicstr function for adslashes filtering, the code conversion can be directly deleted ...

Propana Reload - Exported components, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Propana Reload published at the 'play' market has multiple vulnerabilities...

Symantec VIP Access Desktop Local Code Execution Vulnerability

Symantec VIP Access Desktop is a set of online account security protection software from Symantec Symantec. A local code execution vulnerability exists in Symantec VIP Access Desktop versions prior to 2.2.3, which arises from the program failing to filter user-submitted input. A local attacker...

DEBIAN-CVE-2016-6620

An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions prior to 4.6.4...

WordPress Google Analytics Counter Tracker 3.1.5 PHP Object Injection

------------------------------------------------------------------------ Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability ------------------------------------------------------------------------ Remco Vermeulen, July 2016...

DEBIAN-CVE-2016-6321

Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER...

Remote Code Execution (RCE)

ua-parser is vulnerable to remote code execution RCE. This is due to the unsafe usage of yaml.load, which allows arbitrary script to be executed when a yaml file is loaded...

CVE-2016-9836

The file scanning mechanism of JFilterInput::isFileSafe in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the .php6, .php7, .phtml, and .phpt extensions. Additionally,...

Silk TV Remote - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Silk TV Remote published at the 'play' market has multiple vulnerabilities...

Teo Glober - Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Teo Glober published at the 'play' market has multiple vulnerabilities...

Cross-site scripting vulnerability in KingCMS 'manage_data.php' page

KingCMS is a content management system based on WEB technology. A cross-site scripting vulnerability exists in the KingCMS 'managedata.php' page. The program fails to filter user-supplied input, allowing an attacker to construct a malicious web page and trick users into parsing it to execute...

Banco Internacional - Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Banco Internacional published at the 'play' market has multiple vulnerabilities...

Nginx (Debian-Based Distributions) - Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits !/bin/bash Source: http://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html Nginx Debian-based distros - Root Privilege Escalation PoC Exploit nginxed-root.sh ver. 1.0 CVE-2016-1247 Discovered and coded by: Dawid...

Unspecified Cross-Site Scripting Vulnerability in TYPO3 HTML5 Video Player Extension

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. An unspecified cross-site scripting vulnerability exists in TYPO3 HTML5 Video Player Extension. Because the program fails to properly filter user-supplied input, an attacker could exploit the...

Oracle WebLogic Server Java Object Deserialization RCE (October 2016 CPU)

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WLS Security component due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons File Upload library. An unauthenticated, remote attacker can exploit this, via a crafted a...

CVE-2016-8618

The libcurl API function called curlmaprintf before version 7.51.0 can be tricked into doing a double-free due to an unsafe sizet multiplication, on systems using 32 bit sizet variables...

MySQL / MariaDB / PerconaDB elevation of privilege vulnerability, CVE-2016-6664）

I. VULNERABILITY ------------------------- MySQL / MariaDB / PerconaDB - Root Privilege Escalation MySQL = 5.5.51 = 5.6.32 = 5.7.14 MariaDB All current Percona Server 5.5.51-38.2 5.6.32-78-1 5.7.14-8 Percona XtraDB Cluster 5.6.32-25.17 5.7.14-26.17 5.5.41-37.0 II. BACKGROUND...

Alienvault OSSIM/USM 5.3.1 - PHP Object Injection

Details ======= Product: Alienvault OSSIM/USM Vulnerability: PHP Object Injection Author: Peter Lapp, lappsec gmail com CVE: CVE-2016-8580 Vulnerable Versions: =5.3.1 Fixed Version: 5.3.2 Vulnerability Details ===================== A PHP object injection vulnerability exists in multiple widget...