ManageEngine Multiple Products Arbitrary File Download

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

Multiple Cross-Site Scripting Vulnerabilities in SupportCenter Plus

SupportCenter Plus is a web-based customer support software. Multiple cross-site scripting vulnerabilities exist in SupportCenter Plus. Because input passed to the "/HomePage.do" script via the "fromCustomer" HTTP GET parameter, the "username" and "password" HTTP POST parameters are not properly...

Free Reprintables ArticleFR SQL Injection Vulnerability

Free Reprintables ArticleFR is an article directory scripting system from Free Reprintables Philippines. The system supports search engine optimization, anti-spam filters and page creation. A SQL injection vulnerability exists in the 'getProfile' function in the Free Reprintables ArticleFR...

ManageEngine Multiple Products Arbitrary Directory Listing

This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linux or C:\ in Windows. This vulnerabilit...

MantisBT Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the admin/install.php script in MantisBT versions 1.2.18 and earlier...

Mobile Vikings: Number, username and name disclosure

when user request a new card he can input some viking's number as a referrer and in order review page he can see viking's username When he add authorization to his own sim, he can use not only email but username and as a result he can get full vikings name in auth list. See attach...

Pivotal Software RabbitMQ management plugin cross-site scripting vulnerability

Pivotal Software RabbitMQ is a British company Pivotal Software's set of implementation of the Advanced Message Queuing Protocol AMQP open source messaging agent software. rabbitMQ management is one of the management plug-in . A cross-site scripting vulnerability exists in the Pivotal Software...

X (Formerly Twitter): Insecure Data Storage in Vine Android App

Hi Twitter, - Vulnerability Class:OWASP M2 : Insecure Data Storage Every application needs to store something secret, like a website username,password, cookies etc. , internal storage is the place to do it, android sandbox prevents other applications from accessing this data but,In vine android a...

articleFR CMS 3.0.5 SQL Injection Vulnerability

articleFR CMS version 3.0.5 suffers from a remote SQL injection vulnerability. Vulnerability title: SQL injection vulnerability in articleFR CMS 3.0.5 Product: articleFR Vendor: http://freereprintables.com Affected version: version 3.0.5 Download link: https://github.com/articlefr/articleFR Fixed...

Mangallam SQL Injection

+++++++++++++++++++++++++++++++++ + +Exploit Title : Mangallam CMS Sql Injection Vulnerability + +Exploit Author : Ashiyane Digital Security Team + +Vendor Homepage : http://www.jnvustudents.com/ + +Google Dork ONE : intext:powered by : Mangallam + +Google Dork Two : inurl:/newsview.php?newsid=...

Microsoft Network Policy Server DoS

Crash on username processing in RADIUS request...

ThinkSAAS 2.3 SQL注入

简要描述： ThinkSAAS 2.3 SQL注入 详细说明： app/group/action/add.php 172-197行 // 处理@用户名 if pregmatchall '/@/', $content, $at echo $content; pregmatchall "/@.+?\s|:|$/is", $content, $matches ; $unames = $matches 1; $ns = "'" . implode "','", $unames . "'"; $csql = "username IN$ns"; if $unames $query =...

CVE-2014-100028

Cross-site scripting XSS vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username...

Cross site scripting

Cross-site scripting XSS vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2014-100028

Cross-site scripting XSS vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username...

Sql injection

SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL commands via the username parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Microsoft Network Policy Server RADIUS Denial of Service (MS15-007; CVE-2015-0015)

A denial of service vulnerability exists in the Network Policy Server NPS. The vulnerability is due to the way the NPS handles username strings. A remote attacker can exploit this issue by sending a specially crafted username string to the NPS...

MS15-007: Vulnerability in Network Policy Server RADIUS implementation could cause denial of service: January 13, 2015

None None...

From one upload to Maxthon within the network-vulnerability warning-the black bar safety net

From one upload to Maxthon within the network The first is to find a sub-domain name of the upload custom. maxthon. cn In the upload icon when only verifies the content-type is not on file after the judgment ! 1532ed2be1f9d7260dd9085f527ba9e0. png Simple modification packages to get to the shell ...