Gespage Cross-Site Scripting Vulnerability

Gespage is an application for managing and monitoring printing devices from the French company Gespage. A cross-site scripting vulnerability exists in Gespage. A remote attacker could exploit this vulnerability by adding a printer with a specially crafted name or by injecting arbitrary web script...

Shaarli cross-site scripting vulnerability (CNVD-2018-03979)

Shaarli is a set of website cloning tools from the French Sebsauvage project. A cross-site scripting vulnerability exists in versions of Shaarli before 0.8.5 and 0.9.x before 0.9.3. A remote attacker can exploit this vulnerability to inject arbitrary code via the username field of the login form...

Synology DiskStation Manager (DSM) 6.1.3-15152 - forget_passwd.cgi User Enumeration

Synology DiskStation Manager DSM 6.1.3-15152 - forgetpasswd.cgi User Enumeration Exploit Title: Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' User Enumeration Date: 01/05/2018 Exploit Author: Steve Kaun Vendor Homepage: https://www.synology.com Version: Before 6.1.3-15152 CVE ...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Shaarli contains a Cross-site scripting (XSS) vulnerability in versions prior to 0.8.5 and 0.9.x prior to 0.9.3. An attacker can inject arbitrary code via the login form’s username field (the ban_canLogin parameter in index.php). The issue is addressed in Shaarli v0.9.3 and v0.8.5 releases refere...

Advantech WebAccess BWSCADASoap Login Method SQL Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Advantech WebAccess. The specific flaw exists within processing of the Login method of the BWSCADASoap entry point. When parsing the ProjectName and Username elements, the process does not properly...

"Length cannot be less than zero" error during the Update installation

Challenge The Update for Veeam ONE fails during the installation with the error message "Length cannot be less than zero". Cause User Principal Name or UPN user@domain is currently unsupported with Veeam ONE. User Logon Name or ULN domain\user is the only supported username format for the product...

D-Link DSL-6850U Multiple Vulnerabilities

Exploit for hardware platform in category web applications Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in D-Link DSL-6850U versions BZ1.00.01 – BZ1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found...

Flaw In Major Browsers Allows 3rd-Party Scripts to Steal Your Saved Passwords

Security researchers have uncovered how marketing companies have started exploiting an 11-year-old bug in browsers' built-in password managers, which allow them to secretly steal your email address for targeted advertising across different browsers and devices. The major concern is that the same...

CVE-2017-17933

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

CVE-2017-17933

cgi/surgeftpmgr.cgi aka the Web Manager interface on TCP port 7021 or 9021 in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter...

ZKTeco ZKBioSecurity 3.0 User Enumeration Weakness

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

PHP Scripts Mall Single Theater Booking SQL Injection Vulnerability

PHP Scripts Mall Single Theater Booking is an open source theater script. PHP Scripts Mall Single Theater Booking suffers from a SQL injection vulnerability. A remote attacker can exploit this vulnerability by sending the 'movieid' parameter to the admin/movieview.php file to obtain the username ...

PHP Scripts Mall Resume Clone Script SQL Injection Vulnerability (CNVD-2018-00492)

Resume Clone Script is a resume clone script from PHP Scripts Mall. PHP Scripts Mall Resume Clone Script suffers from a SQL injection vulnerability. A remote attacker can exploit this vulnerability by injecting the 'username' parameter into the forget.php file to obtain user or sensitive data abo...

CVE-2017-17931

PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter...

CVE-2017-17931

PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter...

Sql injection

PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter...

PHP Scripts Mall Readymade Job Site Script SQL Injection Vulnerability

PHP Scripts Mall Readymade Job Site Script is a PHP based job site script by PHP Scripts Mall India. The script includes features like job management, profile management and email notifications. A SQL injection vulnerability exists in PHP Scripts Mall Readymade Job Site Script. A remote attacker...

PHP Scripts Mall Readymade Video Sharing Script SQL Injection Vulnerability

PHP Scripts Mall Readymade Video Sharing Script is a set of PHP based online video sharing website scripts by PHP Scripts Mall India. A SQL injection vulnerability exists in PHP Scripts Mall Readymade Video Sharing Script. A remote attacker can exploit this vulnerability by sending the 'chnlid'...