15181 matches found
niso.org XSS vulnerability
Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...
WakaTime: Two email addresses can access the same account
Hello Team, When I was testing your web application I found that we can change the email address to a new email address. I tested that feature and noticed that after changing the email to a new email and then back to the old email, I can still access the account using both the email addresses...
skyhawkrugs.com XSS vulnerability
Vulnerable URL: http://skyhawkrugs.com/rugs.asp?collection=1"...
topnotchinc.com XSS vulnerability
Vulnerable URL: https://www.topnotchinc.com/docs/forms/employmentapp/application.asp?AttachedResume=No==1"...
WakaTime: Session not expired on logout
Description: Session management issue in https://wakatime.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his account.In secure web application,Cookies immediately expire once the user logs out of his account. But this is not...
SQL Injection Vulnerability in MallBuilder
MallBuilder is a multi-user online shopping mall solution based on PHP+MYSQL. MallBuilder suffers from a SQL injection vulnerability. An attacker can use this vulnerability to steal database information and control the operating system...
CVE-2017-6026
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization an...
CVE-2017-6028
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...
CVE-2017-6038
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
Cross site request forgery (csrf)
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
CVE-2017-6038
A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...
CVE-2017-6026
Affected products: Schneider Electric Modicon PLCs (M241 and M251) with firmware versions prior to 4.0.5.11. Root cause / vulnerability: Use of insufficiently random values in session numbers generated by the web application, leading to potential session compromise due to shared session identifie...
The likelihood of collaborative oa \app\team\block\control.php SQL injection
No description provided by source...
web.jns.ac.in XSS vulnerability
Vulnerable URL: http://web.jns.ac.in/login.asp?corner=1"...
secrestwardle.com XSS vulnerability
Vulnerable URL: http://www.secrestwardle.com/viewprofessional.php?practiceid=1"...
db.continentalcaststone.com XSS vulnerability
Vulnerable URL: http://db.continentalcaststone.com/Security/Login.asp?silent===/main.asp=1"...
Fixed Session Vulnerability in Sierra Wireless GX440
The Sierra Wireless GX440 is a gateway device from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless GX440 devices using version 4.3.2 of the ALEOS firmware. An attacker could exploit the vulnerability to access the management web application...
WordPress Ultimate Product Catalogue 4.2.2 Plugin - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Ultimate Product Catalogue 4.2.2 Sql Injection – Plugin WordPress – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/ Software Link:...
GLPI 0.90.4 SQLi Vulnerability
GLPI is prone to an SQL injection SQLi vulnerability SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:glpi-project:glpi"; if...