Yellow Pages Script 3.2 SQL Injection

Exploit Title: Yellow Pages Script v3.2 - SQL Injection Google Dork: N/A Date: 11.03.2017 Vendor Homepage: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/yellow-pages-script/ Demo: http://demo.phpjabbers.com/index.php?demo=yps&front=1&lid=1 Version: 3.2 Tested on: Win7 x64, Kali...

Magic Deals Web by Jason Web Design,1.2.0,SQL Injection

Magic Deals Web by Jason Web Design, 1.2.0, SQL Injection...

Navetti PricePoint 4.6.0.0 XSS / CSRF / SQL Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: - impact: high/critical homepage:...

Navetti PricePoint 4.6.0.0 XSS / CSRF / SQL Injection Vulnerabilities

Exploit for php platform in category web applications title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: - impact: high/critical homepage: http://www.navetti.com/ found: 2016-07-18 by: W. Schober Office Vienna SEC...

CVE-2017-6544

Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/wwwadmin/users.php id parameter...

Navetti PricePoint 4.6.0.0 - SQL Injection Cross-Site Scripting Cross-Site Request Forgery

Navetti PricePoint 4.6.0.0 - SQL Injection Cross-Site Scripting Cross-Site Request Forgery ======================================================================= title: Multiple vulnerabilities product: Navetti PricePoint vulnerable version: 4.6.0.0 fixed version: 4.7.0.0 or higher CVE number: -...

tomcat: tomcat writable config files allow privilege escalation

It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges...

tomcat: system property disclosure

It was discovered that when a SecurityManager was configured, Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible...

tomcat: unrestricted access to global resources

It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not...

tomcat: system property disclosure

It was discovered that when a SecurityManager was configured, Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible...

OpenEMR Multiple Vulnerabilities

OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...

SMB denial of service vulnerability in the web application on the use-vulnerability warning-the black bar safety net

CVE-2017-0016 SMB 0 day vulnerability can lead to Windows System denial of service, the present article is mainly to explain the vulnerability in a web application use. 2017 2 2 June, security researchers announced a exists in Microsoft Windows SMB in the 0 day Vulnerability, CVE－2017-0016, the...

LocalTapiola: XSS on 3rd party service Localtapiola is using

Basic report information Summary: Localtapiola is using careers.fi service to job applicants at http://www.lahitapiola.fi/tietoa-lahitapiolasta/toihin-meille/avoimet-tyopaikat/haemme-juuri-nyt Description: XSS on 3rd party careers.fi job service which may lead loss of personal data for the...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed sensitive information about the web application or system. @twicedi was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you for notifying us!...

EasyCom For PHP Denial of Service Vulnerability

Easycom is a suite of application solutions. A denial of service vulnerability exists in EasyCom For PHP. It allows attackers to exploit the vulnerability to launch denial of service attacks...

SchoolDir - SQL Injection

SchoolDir - SQL Injection Exploit Title: SchoolDir - SQL Injection Google Dork: N/A Date: 01.03.2017 Vendor Homepage: http://www.brynamics.xyz/ Software: https://codecanyon.net/item/schooldir/19326269 Demo: http://www.brynamics.xyz/schooldir/ Version: N/A Tested on: Win7 x64, Kali Linux x64 Explo...

osTicket 1.9.12 Cross Site Scripting

------------------------------------------------------------------------ Multiple persistent Cross-Site Scripting vulnerabilities in osTicket ------------------------------------------------------------------------ Han Sahin, July 2016...

Joomla com_blog v1.6 - (Pid) SQL Injection Vulnerability

Document Title: =============== Joomla comblog v1.6 - Pid SQL Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2037 Release Date: ============= 2017-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 203...

Joomla com_blog v1.6 - (Pid) SQL Injection Vulnerability

Document Title: =============== Joomla comblog v1.6 - Pid SQL Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2037 Release Date: ============= 2017-02-28 Vulnerability Laboratory ID VL-ID: ==================================== 203...

Cross site scripting

A non-privileged user of the Siemens web application RUGGEDCOM NMS V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Site Scripting XSS attack, potentially resulting in obtaining administrative permissions...