The Next Generation Of Genealogy Sitebuilding SQL Injection Vulnerability

The Next Generation of Genealogy Sitebuilding versions prior to 11.1.1 suffer from a remote SQL injection vulnerability. ========================================================================================== The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability...

Advantech WebAccess Elevation of Privilege Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An elevation of privilege vulnerability exists in Advantec...

Invoice Manager 3.1 - Cross-Site Request Forgery (Add Admin)

Invoice Manager 3.1 - Cross-Site Request Forgery Add Admin ======================================================== Invoice Manager v3.1 Cross site request forgery Add Admin Description : Invoice Manager v3.1 is vulnerable to CSRF attack No CSRF token in place which if an admin user can be tricke...

PYSEC-2017-105

Apache Atlas versions 0.6.0 incubating, 0.7.0 incubating, and 0.7.1 incubating allow access to the webapp directory contents by pointing to URIs like /js and /img...

Burp Suite Free Edition and NTLM authentication in ASP.net applications

As you know, Burp Suit is a scanner for advanced Web Application Security researchers. However, the free version of Burp is more like Firebug analogue, but much more functional. Let's see how to install it and use for website analysis. This analysis may be necessary to find vulnerabilities or...

User Login and Management - Multiple Vulnerabilities

User Login and Management - Multiple Vulnerabilities ----------------------------------------------------------------------------------- | |---------------------------------------------------------------------------------- 1 admin dashboard authentication bypass Description : An Attackers are abl...

The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability

:-------------------------------------------------------------------------------------------------------------------------: : Exploit Title : The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability : Date : 29th August 2017 : Author : X-Cisadane : CMS Name : The Next Generation ...

Schools Alert Management Script - Authentication Bypass

Schools Alert Management Script - Authentication Bypass ======================================================== Schools Alert Management - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular scho...

Matrimony 2.7 Cross Site Request Forgery

======================================================== Matrimony 2.7 Admin account takeover Cross site request forgery Description : change password functionality in the admin panel does not check for current password and no CSRF token in place which allow an Attackers to be able to completely...

Debian DLA-1066-1 : php5 security update

A stack-based buffer overflow in the zendinidoop function in Zend/zendiniparser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input instead of the system's php.ini file for the parseinistring or...

Schools Alert Management Script - Authentication Bypass

======================================================== Schools Alert Management - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school Proof of Concept : -...

Matrimonial Script 2.7 - Authentication Bypass

Matrimonial Script 2.7 - Authentication Bypass ======================================================== admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built upon Matrimonial Script as they can gain access to the admin panel and...

Matrimonial Script 2.7 - Authentication Bypass

======================================================== admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built upon Matrimonial Script as they can gain access to the admin panel and manage the website as an admin without prior...

envirowatertanks.com.au XSS vulnerability

Open Bug Bounty ID: OBB-282272 Description| Value ---|--- Affected Website:| envirowatertanks.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

Information disclosure

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to...

Qualys Cloud Platform 2.30 New Features

This release of the Qualys Cloud Platform version 2.30 includes updates and new features for Cloud Agent, EC2 Connector, Web Application Scanning, Web Application Firewall, and Security Assessment Questionnaire, highlights as follows. This posting has been updated on 9/6/2017 and 10/25/2017 to...