CVE-2018-17486

CVE-2018-17486 affects Lobby Track Desktop (Jolly Technologies). In kiosk mode, an error in the find visitor function could let a local attacker bypass security restrictions and, by visiting the kiosk and using the find visitor option, delete visitor records or remove a host. The available connec...

CVE-2018-17482

Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and clicking on reports, an attacker could exploit this vulnerability to gain access to all visitor records and obtain sensitive information...

Visitor Kiosk Access Systems Riddled with Bugs

Visitor-management systems protect business against physical threats such as unwanted and unidentified guests. But many of these lobby-based perimeter checkpoints are opening up companies to a bevy of cyber-threats. On Monday, IBM’s penetration testing team, X-Force Red, released a report that...

The Overlooked Security Threat of Sign-In Kiosks

New research from IBM shows that several visitor management systems had a rash of vulnerabilities...

Viva Visitor & Volunteer ID Tracking 0.95.1 - fname SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Viva Visitor & Volunteer ID Tracking 0.95.1 - 'fname' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://viva-visitor.sourceforge.io/ Software Link:...

Viva Visitor Volunteer ID Tracking 0.95.1 - fname SQL Injection

Viva Visitor Volunteer ID Tracking 0.95.1 - fname SQL Injection Exploit Title: Viva Visitor & Volunteer ID Tracking 0.95.1 - 'fname' SQL Injection Dork: N/A Date: 2018-10-19 Exploit Author: Ihsan Sencan Vendor Homepage: https://viva-visitor.sourceforge.io/ Software Link:...

Viva Visitor And Volunteer ID Tracking 0.95.1 SQL Injection

Exploit Title: Viva Visitor & Volunteer ID Tracking 0.95.1 - 'fname' SQL Injection Dork: N/A Date: 2018-10-19 Exploit Author: Ihsan Sencan Vendor Homepage: https://viva-visitor.sourceforge.io/ Software Link: https://sourceforge.net/projects/viva-visitor/files/latest/download Version: 0.95.1...

Google Chrome < 61.0.3163.100 Multiple Vulnerabilities

Binary data 700344.pasl...

User Control - Unauthenticated SQL Injection

The User Control plugin has a vulnerability that allows every unauthenticated website visitor to perform arbitrary SQL queries...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

ZKTeco ZKBioSecurity 3.0 User Enumeration Weakness

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

Code injection

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

Web Host Asked to handover IP Addresses of Anti-Trump Website Visitors

By Waqas In total, the government of United States is asking for This is a post from HackRead.com Read the original post: Web Host Asked to handover IP Addresses of Anti-Trump Website Visitors...

Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting

Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting Exploit Title: Piwigo plugin User Tag , Persistent XSS Date: 10 Aug, 2017 Extension Version: 0.9.0 Software Link: http://piwigo.org/basics/downloads Extension link : http://piwigo.org/ext/extensionview.php?eid=441 Exploit Author: Touhid M.Shaikh...

FineCMS SQL Injection Vulnerability (CNVD-2017-15546)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An SQL injection vulnerability exists in FineCMS versions 2017-07-12 and earlier. The vulnerability can be exploited by an attacker to obtain data from the database with the help of the...

resling.co.il XSS vulnerability

Open Bug Bounty ID: OBB-261496 Description| Value ---|--- Affected Website:| resling.co.il Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Says Fireball Malware Threat 'Overblown'

Check Point has ramped down its projections on the impact of the recently disclosed Fireball malware after Microsoft called its initial numbers into question. Details on Fireball were published June 1 by Check Point, which said the malware was the work of a Chinese digital marketing agency called...

Piwigo Plugin Facetag 0.0.3 - Cross-Site Scripting

Exploit Title: Piwigo plugin Facetag , Persistent XSS Date: 31-05-2017 Extension Version: 0.0.3 Software Link: http://piwigo.org/basics/downloads Extension link : http://piwigo.org/ext/extensionview.php?eid=845 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website:...

ZKTeco ZKBioSecurity 3.0 - Cross-Site Request Forgery (Add Superadmin)

Exploit for jsp platform in category web applications !-- ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel:...

ZKTeco ZKBioSecurity 3.0 File Path Manipulation

i? ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel: 1.0.1.0R1916 Access: 6.0.1.0R1757 Elevator:...