15181 matches found
CVE-2017-5617
SVG Salamander (svgSalamander) is affected by CVE-2017-5617: a crafted SVG file can trigger server-side request forgery (SSRF) via an xlink:href attribute in web applications using the library. The vulnerability impacts the SVG rendering component and is described in multiple advisories (e.g., GL...
CVE-2017-5617
The SVG Salamander aka svgSalamander library, when used in a web application, allows remote attackers to conduct server-side request forgery SSRF attacks via an xlink:href attribute in an SVG file...
CVE-2017-5617
The SVG Salamander aka svgSalamander library, when used in a web application, allows remote attackers to conduct server-side request forgery SSRF attacks via an xlink:href attribute in an SVG file...
Zenario v7.6 - Persistent Cross Site Scripting Vulnerability
Document Title: =============== Zenario v7.6 - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2044 https://github.com/TribalSystems/Zenario/commit/cd60f1c8a179ebb779fe0acc051b93f477129b1a Release Date:...
SQL injection vulnerability in mallbuilder frontend plugin_product_class.php page
MallBuilder is a multi-user online shopping mall solution system based on PHP+MYSQL. A SQL injection vulnerability exists in the pluginproductclass.php page in the frontend of mallbuilder, which allows attackers to exploit the vulnerability to obtain sensitive information from the database...
Directory traversal
A directory traversal vulnerability in the web application in McAfee now Intel Security SaaS Control Console SCC Platform 6.14 before patch 1070, and 6.15 before patch 1076 allows unauthenticated users to view contents of arbitrary system files that did not have file system level read access...
Protecting Your Web Apps with AppSpider Defend Until They Can Be Patched
AppSpider scans can detect exploitable vulnerabilities in your applications, but once these vulnerabilities are detected how long does it take your development teams to create code fixes for them? In some cases it could take several days to weeks before a fix/patch to resolve the vulnerability ca...
CVE-2013-7462
The CVE-2013-7462 entry describes a directory traversal vulnerability in McAfee/SCC Platform prior to patch 1070 (6.14) and prior to patch 1076 (6.15). An unauthenticated user could view contents of arbitrary system files that lacked file-system read restrictions via a null-byte injection exploit...
Trello: Email authentication token fails to expire and can be used multiple times for same Email address on Trello.com
Hi there Trello Security Team , I have noticed a certain behaviour at https://trello.com . What I belief to be a bug . Summery: --------------------- You can authenticate an email added on your account with same authentication token multiple times . You remove it , add it again use the same token...
BruteXSS - Tool to find XSS vulnerabilities in web application
BruteXSS is a tool written in python simply to find XSS vulnerabilities in web application. This tool was originally developed by Shawar Khan in CLI. I just redesigned it and made it GUI for more convienience. This tool is developed in Python, so obviously cross platform, you just need Python...
CVE-2017-5675
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will b...
CVE-2017-5675
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will b...
CVE-2017-5675
The CVE-2017-5675 issue affects a custom GoAhead web server used in Foscam, Vstarcam, and multiple white-label IP cameras. The mail.htm page’s mail-sending form allows an attacker to inject a command into the receiver1 field, which is then executed with root privileges. The vulnerability is trigg...
Nextcloud: Content spoofing due to the improper behavior of the 403 page
Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. PoC:...
Property Listing Script 3.1 - SQL Injection
Exploit Title: Property Listing Script v3.1 - SQL Injection Google Dork: N/A Date: 11.03.2017 Vendor Homepage: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/property-listing-script/ Demo: http://demo.phpjabbers.com/index.php?demo=pls&front=1&lid=1 Version: 3.1 Tested on: Win7...
Yellow Pages Script 3.2 SQL Injection
Exploit Title: Yellow Pages Script v3.2 - SQL Injection Google Dork: N/A Date: 11.03.2017 Vendor Homepage: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/yellow-pages-script/ Demo: http://demo.phpjabbers.com/index.php?demo=yps&front=1&lid=1 Version: 3.2 Tested on: Win7 x64, Kali...
Magic Deals Web by Jason Web Design,1.2.0,SQL Injection
Magic Deals Web by Jason Web Design, 1.2.0, SQL Injection...
Navetti PricePoint 4.6.0.0 XSS / CSRF / SQL Injection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: - impact: high/critical homepage:...
Navetti PricePoint 4.6.0.0 XSS / CSRF / SQL Injection Vulnerabilities
Exploit for php platform in category web applications title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: - impact: high/critical homepage: http://www.navetti.com/ found: 2016-07-18 by: W. Schober Office Vienna SEC...
