Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Daily Expense Manager 1.0 - Cross-Site Request Forgery Delete Income Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager...

SQL Injection Vulnerability in ASK2 Q&A System Ap***.php File

ASK2 Q&A is an open source PHP Q&A program. ASK2 Q&A System Ap.php file has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Open-School Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School version 3.0 and Community Edition version 2.3...

TeamPass Cross-Site Scripting Vulnerability (CNVD-2020-16615)

TeamPass is an open source password manager. A cross-site scripting vulnerability exists in TeamPass version 2.1.27.35, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

Nature Easy Soft Network Technology ZenTao Cross-Site Scripting Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

College Notes Management System 1.0 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: email protected Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/...

Top 10 Practices for Securing Cloud Workloads

Public cloud is one of the biggest challenges in every IT organization. While driving greater scalability, performance, and access for a competitive edge, it also introduces new security risks. More than just hosted data center infrastructure, public cloud offers the promise of agility, efficienc...

cPanel cross-site scripting vulnerability (CNVD-2019-26352)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in versions prior to cPanel 70.0.23. The vulnerability stems from a lack of proper...

Gogs < 0.11.91 Improper Access Vulnerability

Gogs is prone to an improper access vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Invenio-records Cross-Site Scripting Vulnerability

invenio-records is a metadata storage module. A cross-site scripting vulnerability exists in versions of invenio-records prior to 1.2.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Opengear console server cross-site scripting vulnerability

Opengear console server is a console server from Opengear USA. It is capable of managing network, server, and power infrastructures with monitoring, troubleshooting, and remediation features. A cross-site scripting vulnerability exists in the Opengear console server using firmware versions prior ...

What We Can Learn from the Capital One Hack

On Monday, a former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. Since then, many have speculated the breach was perhaps the result of a previously unknown "zero-day" flaw, or an "insider" attack in which the accus...

Qualys Cloud Platform 2.40 New Features

This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...

Sar2HTML 3.2.1 - Remote Command Execution

Sar2HTML 3.2.1 - Remote Command Execution Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web...

College Notes Management System 1.0 Cross Site Request Forgery

Exploit Title: College Notes Management System 1.0 - CSRF Add Note Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 3, 2019 Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/ Software Link:...

Sar2HTML 3.2.1 - Remote Command Execution

Exploit Title: sar2html Remote Code Execution Date: 01/08/2019 Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application you will see index.php?plot url...

Sar2HTML 3.2.1 - Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: sar2html Remote Code Execution Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application y...

WordPress Fastest Cache Plugin < 0.8.9.6 Directory Traversal Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

SAP Information Steward Cross-Site Scripting Execution Vulnerability

SAP Information Steward is a data management and integrity solution from SAP. The product supports data analysis, data along and metadata management and other functions. A cross-site scripting vulnerability exists in SAP Information Steward version 4.2. The vulnerability stems from a lack of prop...

WallacePOS Cross-Site Request Forgery Vulnerability

WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site request forgery vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from...