eapmd5pass 'extract_eapusername' function denial of service vulnerability

eapmd5pass is a penetration testing tool for attacks against the EAP-MD5 protocol. A security vulnerability exists in the 'extracteapusername' function in eapmd5pass version 1.4. A remote attacker can exploit this vulnerability by generating specially crafted network traffic to cause the eapmd5pa...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...

Vik Rent Items 1.3 and previous

Vik Rent Items 1.3 and previous SQL injection Resolution:update to version 1.4 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...

Authentication flaw

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Build 09123015 and previous versions, OnCell G3150-HSDPA Version 1.4 Build 11051315 and previous versions,...

XYCMS column management module pid parameters have sql injection vulnerability

XYCMS, formerly known as Nanjing XYCMS Enterprise Station Building System, is a station building platform that provides one-stop web solutions for Chinese enterprises. XYCMS PHP version 1.4 version of the column management module there is a sql injection vulnerability, due to the pid parameter...

PlaySMS Remote Code Execution Vulnerability (CNVD-2017-08174)

PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A remote code execution vulnerability exists in the import.php file a.k.a. phonebook import function in PlaySMS version 1.4. A remote...

Moxa AWK Series Systemlog Information Disclosure Vulnerability

Moxa AWK series wireless access points are prone to a systemlog.log information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Geutebrueck GCore 1.3.8.42 / 1.4.2.37 Code Execution

Exploit Title: Geutebrueck GCore X64 Full RCE Bufferoverflow for Metasploit Date: 20170125 Exploit Author: Luca Cappiello, Maurice Popp ContactTwitter: @dopamined, @m4p0 Github: https://github.com/m4p0/GeutebrueckGCoreX64RCEBO Vendor Homepage:...

iucode-tool buffer overflow vulnerability

iucode-tool is a set of microcode tools for operating Intel-registered i686 and X86-64 system processors. A heap buffer overflow vulnerability exists in iucode-tool versions 1.4 through 2.1, which originates when the program fails to properly perform bounds detection on user-submitted data,...

UBUNTU-CVE-2017-0357

A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption...

Cross-site scripting vulnerability in yxcms Referer parameter

YXcms is a website management system based on PHP+MySql with a lightweight MVC design model. A cross-site scripting vulnerability exists in the Referer parameter on the yxcms\protected\apps\member\controller\indexController.php page in yxcms V1.4. Because the program does not filter the...

Moxa DACenter Local Elevation of Privilege Vulnerability

Moxa DACenter is an OPC interface from Moxa that interacts with the Moxa Active OPC server for real-time data collection. A local privilege vulnerability exists in Moxa DACenter version 1.4 and earlier. An attacker could exploit this vulnerability to gain elevated privileges...

Stored Cross-Site Scripting Vulnerability in Dream Cms

Dream cms, abbreviated as "lmxcms", is an open source website management system cms with no license restrictions. Dream CMS version 1.4 management background can be triggered by the administrator to reply to the message board to store the type of cross-site script , allowing attackers to exploit...

UBUNTU-CVE-2016-8596

Buffer overflow in the cspcanprocessframe in cspifcan.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet...

UBUNTU-CVE-2016-8598

Buffer overflow in the zmq interface in cspifzmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet...

Wordpress filedownload plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language. filedownload is one of the file download plugin. A security vulnerability exists in Wordpress filedownload plugin v1.4, which can be exploited by an attacker to execute malicious code on a...

Wordpress filedownload plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language. filedownload is one of the file download plugin. A SQL injection vulnerability exists in version v1.4 of the Wordpress filedownload plugin, which can be exploited by an attacker to execute...

Moxa DACenter Vulnerabilities

OVERVIEW Independent researcher Zhou Yu has identified denial-of-service and unquoted service path privilege escalation vulnerabilities in Moxa’s DACenter application. Moxa has produced a patch to mitigate these vulnerabilities. Zhou Yu has tested the patch to validate that it resolves the...

WordPress plugin Vospari Forms <= 1.3 - Reflected Cross-Site Scripting (XSS) vulnerability

WordPress plugin Vospari Forms version 1.3 vulnerable to Reflected Cross-Site Scripting XSS. Altering the URL would allow for the XSS to be executed for further exploitation. Solution Update plugin to the latest version at least version 1.4...

SquidGuard Cross-Site Scripting Vulnerability

Shalla Secure Services squidGuard is a URL redirection plug-in for Squid proxy server and web caching server software from Shalla Secure Services, Germany. A cross-site scripting vulnerability exists in versions 1.3 and 1.4 of squidGuard. An attacker can exploit this vulnerability to inject...