Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw

The massive Equifax data breach that exposed highly sensitive data of as many as 143 million people was caused by exploiting a flaw in Apache Struts framework, which Apache patched over two months earlier of the security incident, Equifax has confirmed. Credit rating agency Equifax is yet another...

FoodStar 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications...

[SECURITY] Fedora 25 Update: gd-2.2.5-1.fc25

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

[SECURITY] Fedora 26 Update: gd-2.2.5-1.fc26

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the...

Car or Cab Booking Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications...

LiveInvoices 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: LiveInvoices 1.0 - SQL Injection Dork: N/A Date: 18.08.2017 Vendor Homepage : http://livecrm.co/ Software Link: https://codecanyon.net/item/liveinvoices-complete-invoicing-system-crm/20243375 Demo:...

Matrimony Script 2.7 - SQL Injection Vulnerability

Exploit for php platform in category web applications...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

Sn1per - Automated PenTest Recon Scanner

Sn1per is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. DEMO VIDEO: FEATURES: Automatically collects basic recon ie. whois, ping, DNS, etc. Automatically launches Google hacking queries against a target domain Automatically enumerates...

tomcat: Calls to application listeners did not use the appropriate facade object

A vulnerability was discovered in tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web...

Cross site scripting

Cross-site scripting XSS vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the...

CVE-2017-11593

Cross-site scripting XSS vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the...

CVE-2017-11593

Markdown Preview Plus (MPP) extension for Chrome is affected by a cross-site scripting (XSS) vulnerability in versions prior to 0.5.7. The issue arises when crafted text/markdown/rst files intended to be displayed as plain text are uploaded and then converted to HTML without proper sanitization, ...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

Security Update for Microsoft Silverlight (KB4023307)

This security update to Silverlight includes fixes outlined in KB 4023307. This update is backward compatible with web applications built using previous versions of Silverlight...

BSA-2017-306

Security Advisory ID : BSA-2017-306 Component : Apache Tomcat Revision : 1.0: Interim While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under aSecurityManager, it was therefore...

Personify360 7.5.2/7.6.1 - Improper Access Restrictions

Exploit Title: Access and read and create vendor / API credentials in plaintext Date: 3/29/2017 Exploit Author: Pesach Zirkind Vendor Homepage: https://personifycorp.com/ Version: 7.5.2 - 7.6.1 Tested on: Windows all versions CVE : CVE-2017-7312 Category: webapps 1. Description Any website visito...

Virtual Patching: A Lifesaver for Web App Security

Here’s a common scenario organizations increasingly face: Too many web apps with too many vulnerabilities and no chance for immediate remediation. In the interim, the organization is left exposed to potentially devastating breaches, at a time when web apps have become one of cyber attackers’...

Debian Security Advisory DSA 3842-1 (tomcat7 - security update)

Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine. CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. CVE-2017-5648 Some application listeners calls were issued against the wrong...