7384 matches found
Simple Events Calendar <= 1.3.5 - Authenticated SQL Injection
Type user access: administrator user. $POST‘eventid’ is not escaped. File / Code: Path Request: /wp-content/plugins/simple-events-calendar/simple-events-calendar.php Line : 467 $editevent = $POST'eventid'; $update = $wpdb-getresults " SELECT FROM $tablename WHERE id = $editevent ", "ARRAYA" ;...
WordPress Plugin Polls 1.2.4 - SQL Injection (PoC)
Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Vulnerable version:Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip //////////////////////// /// Overview: //////////////////////// WordPress Polls plugin is a tool for creating polls and survey...
CVE-2017-15361
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module TPM firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various...
Red Hat FreeIPA Design Vulnerability
Red Hat FreeIPA is an integrated security information management solution from Red Hat, Inc. The solution provides an easy-to-manage identity, policy and audit IPA suite for Linux and Unix computer networks. A security vulnerability exists in Red Hat FreeIPA. An attacker could exploit this...
Hubei Radio and Television Station Yangtze River Cloud Android APP suffers from overstepping access vulnerability
Yangtze River Cloud Android APP is a news and information software created by Hubei Radio and Television Station, which integrates the three functions of government affairs, news and information, and life services. A vulnerability exists in the Hubei Radio and Television Changjiang Cloud Android...
Hydrogen Krypton Travel App for Android suffers from an override access vulnerability
Hydrogen Krypton Travel APP is a comprehensive service platform in the field of new energy vehicles. The vulnerability exists in "My Wallet" and "My Orders" in the Android version of Hydrogen Krypton Mobility APP, which allows an attacker to view any user's details by using their cell phone numbe...
Eaton ELCSoft Out-of-Bounds Access Remote Code Execution Vulnerability
The Eaton ELCSoft programmable logic control software runs on a PC and can help configure the ELC controller. An out-of-bounds access remote code execution vulnerability exists in Eaton ELCSoft, where memory access exceeds the end of the allocation buffer due to the program process failing to...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
Stored Cross-Site Scripting Vulnerability in PlayStation Live App
Playcaster Live App is a short video live interactive application. Playcafe Live App has a stored cross-site scripting vulnerability that allows an attacker to insert malicious js code into the page to obtain user cookies and other information...
Zomato: Admin Access to a domain used for development and admin access to internal dashboards on that domain
@prateek0490 Was able to find our development server without any authentication. Which leads to leak the user data and some internal dashboards...
CVE-2015-5179
FreeIPA might display user data improperly via vectors involving non-printable characters...
CVE-2015-5179
FreeIPA might display user data improperly via vectors involving non-printable characters...
Design/Logic Flaw
FreeIPA might display user data improperly via vectors involving non-printable characters...
CVE-2015-5179
FreeIPA might display user data improperly via vectors involving non-printable characters...
DEBIAN-CVE-2015-5179
FreeIPA might display user data improperly via vectors involving non-printable characters...
CVE-2015-5179
FreeIPA might display user data improperly via vectors involving non-printable characters...
CVE-2015-5179
Technical details (affected components, root cause, and patch status) are not publicly provided in the connected documents. Monitor vendor advisories and security trackers for updates.
Variable Override Vulnerability in SchoolCMS
SchoolCMS is a school teaching management system based on PHP+MySQL. SchoolCMS suffers from a variable override vulnerability. An attacker can utilize the browser's TAB function to override access to user information...
ofun.de XSS vulnerability
Vulnerable URL: http://ofun.de/include/userdata.html Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 365766 VIP website status:| No Coordinated Disclosure Timeline: Description| Val...