Cross site scripting

SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element...

Cross site request forgery (csrf)

SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...

Cross site scripting

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

CVE-2019-13950

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

CVE-2019-13949

SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...

CVE-2019-13948

The CVE-2019-13948 issue affects SyGuestBook A5 Version 1.2, where a stored XSS vulnerability arises from isValidData not properly filtering XSS payloads in include/functions.php. TheExploit vector demonstrated uses an onerror attribute in an IMG tag to inject script, enabling script execution in...

Doomseeker Sonic Robo Blast 2 Plugin Denial of Service Vulnerability

Doomseeker is a cross-platform server browser for Doom shooter from the Doomseeker team.Sonic Robo Blast 2 SRB2 plugin is one of the game plugins. A security vulnerability exists in the SRB2 plugin in Doomseeker versions 1.1 and 1.2. A remote attacker could exploit this vulnerability to cause a...

DEBIAN-CVE-2019-13045

Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server...

Cloudera Data Science Workbench Information Disclosure Vulnerability

Cloudera Data Science Workbench CDSW is a suite of data science platforms from Cloudera. The platform provides organizations with fast, easy and secure self-service data science support. An information disclosure vulnerability exists in CDSW versions 1.2.x through 1.4.0. The vulnerability stems...

CVE-2019-6139

Forcepoint User ID FUID server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on...

All in One Video Downloader 1.2 - (Authenticated) SQL Injection

All in One Video Downloader 1.2 - Authenticated SQL Injection Exploit Title: All in One Video Downloader 1.2 - SQL Injection Google Dork: "developed by Niche Office" Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage:...

WordPress Adicon Server 1.2 Plugin - selectedPlace SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection Software Link: https://wordpress.org/plugins/adicons/ Exploit Author: Kaimi Website: https://kaimi.io Version: 1.2 Category: webapps SQL Injection File:...

TP-Link TL-R600VPN HTTP Server Buffer Overflow Vulnerability (CNVD-2018-23626)

The TP-Link TL-R600VPN is an enterprise router from China P&L TP-LINK. the HTTP Server is one of the HTTP servers. A buffer overflow vulnerability exists in the HTTP Server in TP-Link TL-R600VPN HWv3 FRNv1.3.0 version and HWv2 FRNv1.2.3 version. An attacker can exploit the vulnerability to execut...

GHSA-3PPH-2595-CGFH There is a XML external entity expansion (XXE) vulnerability in Apache Solr

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...

MV Video Sharing Software 1.2 - searchname SQL Injection

MV Video Sharing Software 1.2 - searchname SQL Injection Exploit Title: MV Video Sharing Software 1.2 - 'searchname' SQL Injection Dork: N/A Date: 2018-10-16 Exploit Author: Ihsan Sencan Vendor Homepage: https://melerovideo.com/software/ Software Link:...

SAP Business One Android Application Certificate Validation Security Bypass Vulnerability

SAP Business One Android application is an Android-based business management software for small businesses from SAP. A certificate validation security bypass vulnerability exists in version 1.2 of the SAP Business One Android application, which can be exploited by an attacker to conduct a...

CVE-2018-2460

SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack...

FB Inboxer 1.2 SQL Injection

Exploit Title: FB Inboxer 1.2 - 'searchfield' SQL Injection Google Dork: N/A Date: 02.08.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage: https://codecanyon.net/item/pageresponse-a-fb-inboxer-addon-facebook-auto-commentprivate-reply-likeshare-for-full-page/21486371 Version: 1.2...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageSight (CVE-2016-0402 and CVE-2015-5041)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 7R1 that are used by IBM MessageSight. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2016-0402 DESCRIPTION: An...

Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-4463)

Summary IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities. IBM Streams has addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-4463 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by a stack-based buffer...