CVE-2018-16386

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...

CVE-2018-16386

SWIFT Alliance Web Platform 7.1.23 is affected. The issue is a log injection vulnerability where PATH_INFO to swp/login/EJBRemoteService/ can lead to arbitrary log filename and injection in error logs (null@java:comp/env/ error messages) as described in CVE-2018-16386 entries. The connected docum...

CVE-2018-16386: Improper Encoding or Escaping of Output

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...

[SECURITY] Fedora 29 Update: wpewebkit-2.24.1-1.fc29

WPE allows embedders to create simple and performant systems based on Web platform technologies. It is designed with hardware acceleration in mind, leveraging common 3D graphics APIs for best performance...

Highly Critical Drupal CMS Flaw Affects Millions of Websites

The Drupal open-source content management system platform has issued an advisory for a highly critical remote-code execution RCE flaw in the Drupal core. The vulnerability CVE-2019-6340 arises from the fact that “some field types do not properly sanitize data from non-form sources,” according to...

S-CMS hospital website builder system b***.php file suffers from SQL injection vulnerability

S-CMS hospital station building system is developed by asp+access/mssql, easy to operate, convenient, support PC+mobile+WeChat. There is a SQL injection vulnerability in the b.php file of S-CMS Hospital Building System. Attackers can use the vulnerability to obtain sensitive information in the...

Fiserv Flaw Exposed Customer Data at Hundreds of Banks

Fiserv, Inc., a major provider of technology services to financial institutions, just fixed a glaring weakness in its Web platform that exposed personal and financial details of countless customers across hundreds of bank Web sites, KrebsOnSecurity has learned. Brookfield, Wisc.-based Fiserv...

Arbitrary File Deletion Vulnerability in Ctcms

Ctcms is a fast website building system that runs on PHP+MYSQL environment. Ctcms has an arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files...

DejaVU - Open Source Deception Framework

Deception techniques if deployed well can be very effective for organizations to improve network defense and can be a useful arsenal for blue teams to detect attacks at very early stage of cyber kill chain. But the challenge we have seen is deploying, managing and administering decoys across larg...

The vulnerability in the Splunk Web platform for operational analysis of Splunk Enterprise’s web interface allows a perpetrator to bypass existing access restrictions or perform arbitrary actions on behalf of legitimate users.

The vulnerability of the Splunk Web platform for operational analysis in Splunk Enterprise is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions or perform arbitrary actions on behalf of legitimate syst...

FS Realtor Clone SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Realtor Clone - 'id' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/realtor-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac O...

SQL Injection Vulnerability in 4a Web-based Teaching Platform System

The "4A Network Teaching Platform" is the preliminary result of the National Modern Distance Education Project Key Technology Research Project "Development of National Modern Distance Education Support System", and it is the earliest network teaching platform researched and developed in China. Th...

Sakai 10.7 Cross Site Scripting / Local File Inclusion

i? Sakai 10.7 Multiple Vulnerabilities Vendor: Apereo Foundation Product web page: https://www.sakaiproject.org Affected version: 10.7 Kernel 10.7 Summary: Sakai is a free, community source, educational software platform designed to support teaching, research and collaboration. Systems of this ty...

net2ftp 1.0 Cross Site Scripting

Summary Subject: net2ftp XSS in "command" and "urlwithpw" parameters Versions vulnerable: ALL Tested on latest, version 1.0 Category: 0-day Impact: Medium Description of the product net2ftp is a web based FTP client http://www.net2ftp.com/index.php . It can be used as a standalone version and als...

Wowza Streaming Engine 4.5.0 - Remote Privilege Escalation

Wowza Streaming Engine 4.5.0 - Remote Privilege Escalation input type="hidden" name="version" value="0"...

Gratipay: Getting Error Message and in use python version 2.7 is exposed.

Getting Error Message and in use python version 2.7 is exposed. Application is unnecessarily exposing the following response headers and message which divulge its choice of web platform: Request is undecodable. /app/.heroku/python/lib/python2.7/encodings/utf8.py:16...

Liferay Portal 5.1.2 - Persistent Cross-Site Scripting

Liferay Portal 5.1.2 - Persistent Cross-Site Scripting Exploit Title: Liferay Portal 5.1.2 - Persistent XSS Discovery Date: 2016-02-10 Exploit Author: Sarim Kiani Vendor Homepage: https://www.liferay.com Software Link: https://www.liferay.com/community/releases Version: 5.1.2 Tested on: Windows O...

Liferay Portal 5.1.2 Cross Site Scripting

Exploit Title: Liferay Portal 5.1.2 - Persistent XSS Discovery Date: 2016-02-10 Exploit Author: Sarim Kiani Vendor Homepage: https://www.liferay.com Software Link: https://www.liferay.com/community/releases Version: 5.1.2 Tested on: Windows OS Liferay Portal 5.1.2 is an open source version of...

大汉互动网络平台 /lm/front/api/opr_datacall.jsp 参数vc_id SQL注入漏洞

No description provided by source...

If we stand still, we go backwards

Recently, ppk claimed the web is going too fast in the wrong direction, and asked for a year's moratorium on web features. I was so angry I ran straight to a dictionary to find out what "moratorium" meant. Turns out it means "suspension". I got a bit snarky about it on Twitter, which isn't really...