JVN#68244135: rNote vulnerable to cross-site scripting

rNote provided by Woody Rinn is software to create a blog. rNote contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing an website that uses rNote. Solution Consider stop using rNote 0.9.7.5 Since the...

SUSE-SU-2020:2198-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.28.4 bsc1174662: + Fix several crashes and rendering issues. + Security fixes: CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925...

Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr

Description dolibarr is a modern and easy to use web software to manage your business. The error page is vulnerable to self XSS because of lack of escaping on $SERVER'HTTPUSERAGENT' variable before printing it. The flaw is in the dolprinterror function in the htdocs/core/lib/functions.lib.php fil...

Unauthorized Access Vulnerability in ZKTime Web Software

ZKTime Web Software is a web-based service management system for ZKTime. An unauthorized access vulnerability exists in ZKTime Web Software, which can be exploited by an attacker to unauthorizedly download a dat backup file containing sensitive database information...

Netartmedia PHP Real Estate Agency 4.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Netartmedia PHP Real Estate Agency 4.0 - SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/propertyagency/ Demo Site: https://www.phpscriptdemos.com/agency/ Version: 4.0 Tested on: Kali...

Netartmedia PHP Real Estate Agency 4.0 - SQL Injection

Netartmedia PHP Real Estate Agency 4.0 - SQL Injection Exploit Title: Netartmedia PHP Real Estate Agency 4.0 - SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/propertyagency/ Demo Site: https://www.phpscriptdemos.com/agency/ Version: 4...

Netartmedia PHP Real Estate Agency 4.0 - SQL Injection

Exploit Title: Netartmedia PHP Real Estate Agency 4.0 - SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/propertyagency/ Demo Site: https://www.phpscriptdemos.com/agency/ Version: 4.0 Tested on: Kali Linux CVE: N/A Description:PHP Real...

Netartmedia Event Portal 2.0 - Email SQL Injection

Netartmedia Event Portal 2.0 - Email SQL Injection Exploit Title: Netartmedia Event Portal 2.0 - 'Email' SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/eventportal/ Demo Site: https://www.phpscriptdemos.com/events/ Version: 2.0 Tested...

Netartmedia Event Portal 2.0 - Email SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Netartmedia Event Portal 2.0 - 'Email' SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/eventportal/ Demo Site: https://www.phpscriptdemos.com/events/ Version: 2.0...

Design/Logic Flaw

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

CVE-2017-17056

The CVE-2017-17056 entry concerns ZKTime Web Software 2.0.1.12280. The vulnerability is a Cross-Site Request Forgery (CSRF) in the Modify Password component’s password_change() function, reachable via old_password/new_password1/new_password2 to /accounts/password_change/. An attacker can craft a ...

CVE-2017-17056

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

ZKTime Web Software Cross-Site Scripting Vulnerability

ZKTeco ZKTime Web Software is a time and attendance management system from ZKTeco, Inc. A cross-site scripting vulnerability exists in ZKTeco ZKTime Web Software version 2.0.1.12280. An attacker could exploit this vulnerability to elevate privileges to administrator privileges...

CVE-2017-17056: Cross-Site Request Forgery (CSRF)

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'passwordchange' function of the Modify Password component, reachable via the oldpassword, newpassword1, and newpassword2 parameters to the /accounts/passwordchange/ URI. An...

Atlassian FishEye and Crucible Detection (HTTP)

HTTP based detection of Atlassian FishEye and Crucible. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZKTime Web Software 2.0 - Improper Access Restrictions

Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category: WebApps Author: Arvind V. Author Social: @FindArvind...

Ramui Forum Script 9.0 - SQL Injection

Ramui Forum Script 9.0 - SQL Injection Title: Ramui forum script 9.0 SQL Injection Exploit Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com/ Download: http://ramui.com/forum-script/download-v9.html Google-Dork: n/a ---Script-Kiddie protection! : Direct SQL-Path: n/a...

Ramui Forum Script 9.0 - SQL Injection

Exploit for php platform in category web applications Title: Ramui forum script 9.0 SQL Injection Exploit Author: bd0rk Twitter: twitter.com/bd0rk Vendor: http://www.ramui.com/ Download: http://ramui.com/forum-script/download-v9.html Google-Dork: n/a ---Script-Kiddie protection! : Direct SQL-Path...

XenForo Forum Detection

This script detects an installed XenForo Forum. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...