The vulnerability of the library authentication function in WEBrick allows a hacker to execute arbitrary commands.

The vulnerability of the WEBrick library’s authentication function in the Ruby distribution is related to incorrect processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to inject control sequences and execute arbitrary commands in the user’s...

Expiring Download Links SQL Injection Vulnerability

Protected Links - Expiring Download Links is a download link adding script, through which you can set the number of clicks and the time of existence of the link, etc.. A SQL injection vulnerability exists in Protected Links - Expiring Download Links version 1.0. A remote attacker can inject SQL...

CVE-2017-15977

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter...

CVE-2017-15977

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter...

CVE-2017-15986

CPA Lead Reward Script allows SQL Injection via the username parameter...

Sql injection

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter...

CVE-2017-15977

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter...

CVE-2017-15986

CPA Lead Reward Script allows SQL Injection via the username parameter...

NQ Contacts Backup&Restore Information Disclosure Vulnerability (CNVD-2017-35644)

NQ Contacts Backup&Restore application for Android is a set of data backup and recovery software based on Android platform. A security vulnerability exists in version 1.1 of the NQ Contacts Backup&Restore application for Android, which originates when the program passes a plaintext username along...

Protected Links - SQL Injection

Protected Links - SQL Injection Username Password...

CVE-2017-15999

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...

Gratipay: Bypassing X-frame options

bypass X-Frame-Options Proxy protection NOT used DomainUsing: gratipay.com Proxy protection NOT used , i can bypass X-Frame-Options header and recreate clickjacking on the whole domain. I see that you don't have a reverse proxy protection this allows all users to proxy your website rather than...

CVE-2017-15958

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php...

Mozilla Firefox URL Long user name Denial Of Service (CVE-2017-7783)

A denial-of-service vulnerability exists in Mozilla Firefox. Mozilla Firefox fails to properly process a combination of username and password inside the URL. A remote attacker could exploit this vulnerability by persuading a target user to open a specially crafted html site...

FreeBSD : GitLab -- multiple vulnerabilities (418c172b-b96f-11e7-b627-d43d7e971a1b)

GitLab reports : Cross-Site Scripting XSS vulnerability in the Markdown sanitization filter Yasin Soliman via HackerOne reported a Cross-Site Scripting XSS vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL...

phpwcms Cross-Site Scripting Vulnerability

phpwcms is a flexible, fast, robust, customer and developer friendly and powerful web-based content management system and cms framework based on PHP and MySQL. A cross-site scripting vulnerability exists in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php in...

Design/Logic Flaw

phpwcms 1.8.9 has XSS in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php via the username aka newlogin field...

CVE-2017-15867

Multiple cross-site scripting XSS vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefrom, 2 dateto, 3 userid, 4 username, 5 countryname, 6 browser, 7 operatingsystem, or 8 ipaddress parameter to...

CVE-2017-15867

The CVE-2017-15867 case concerns the WordPress User Login History plugin (versions up to 1.5.2). The issue is a Cross-Site Scripting (XSS) vulnerability where user-supplied HTTP GET parameters (date_from, date_to, user_id, username, country_name, browser, operating_system, ip_address) are inserte...

Local API Login Credentials Disclosure in paratrooper-pingdom

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process. Vulnerable Code: From: paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb ruby def setupoptions = %xcurl https://api.pingdom.com/api/2.0/checks -X PUT ...