CVE-2020-26884

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application...

It's universal: We all love to exchange gifts. Singles' Day and Diwali are two more reasons to do so.

There is scientific evidence that humans secrete "feel good" chemicals in their brain, such as serotonin, dopamine, and oxytocin, while giving. So it's no wonder that many of us look forward to the holidays. Online mobile shopping trends for Singles' Day and Diwali certainly confirm that. Sadly,...

VTiger v7.0 CRM - (To) Persistent Email Vulnerability

Document Title: =============== VTiger v7.0 CRM - To Persistent Email Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2227 Release Date: ============= 2020-11-18 Vulnerability Laboratory ID VL-ID: ==================================== 2227...

Dell EMC RSA Archer 注入漏洞

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An injection vulnerability exists in Dell EMC RSA Archer versions 6.8...

CVE-2020-25890

CVE-2020-25890 affects the Kyocera ECOSYS M2640IDW web application. The vulnerability is a Stored XSS flaw discovered when adding a new contact in the "Machine Address Book." Successful exploitation can lead to administrator session hijacking or execution of unwanted actions within the web app. T...

Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection

Exploit Title: Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection Google Dork: N/A Date: 11/16/2020 Exploit Author: Ramil Mustafayev Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/ Software...

Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting

Exploit Title: Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-11-12 Vendor Homepage: https://froxlor.org/ Software Link: https://froxlor.org/download/ Version: 0.10.16 Document Title: =============== Froxlor v0.10.16 ...

Kyocera ECOSYS M2640IDW Cross-Site Scripting Vulnerability

The Kyocera ECOSYS M2640IDW is a multifunction printer from Kyocera, Japan. A cross-site scripting vulnerability exists in Kyocera printer ECOSYS M2640IDW, which was discovered when adding a contact to Machine Address Book. Successful exploitation of this vulnerability could result in the hijacki...

SugarCRM 6.5.18 - Persistent Cross-Site Scripting

Exploit Title: SugarCRM 6.5.18 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-11-16 Vendor Homepage: https://www.sugarcrm.com Version: 6.5.18 Document Title: =============== SugarCRM v6.5.18 - Contacts Persistent Cross Site Web Vulnerability References Source:...

vulhub

It is an offensive tool for web application security training. The repository contains a collection of pre-built vulnerable environments based on Docker-Compose. The tool is designed to provide a simple way to create and manage vulnerable environments for web application security training. The...

Defining Vulnerability Risk Management (and How to Build a Modern VRM Program)

Once upon a time just a handful of years ago, vulnerability management programs focused solely on servers, running quarterly scans that targeted only critical systems. But that was then, and you can’t afford such a limited view in the now. Truth is, vulnerability exploitation now happens...

JetBrains YouTrack 代码问题漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack versions prior to 2020.3.888 that stem...

Taskcafe 0.1.0 / 0.1.1 Cross Origin Resource Sharing

Exploit Title: Taskcafé 0.1.0 and 0.1.1- Cross-Origin Resource Sharing Date: 2020- 09- 02 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://github.com/JordanKnott/ Software Link: https://github.com/JordanKnott/taskcafe Version: 0.1.0 and 0.1.1 Tested on: Kali Linux 2020.3 POC: The web...

Mail.ru: Django Debug=True Leaks admin email addresss and serval system information

Domain, site, application weblate.ucs.ru Steps to reproduce For getting all Url Patterns 1.Open https://weblate.ucs.ru / 2.now after / enter any random string 3.It will open 404 page which contains all the Url Patterns of Website For getting all debug info 1.Open https://weblate.ucs.ru 2. Now go ...

Froxlor v0.10.16 CP - (Customer) Persistent Vulnerability

Document Title: =============== Froxlor v0.10.16 CP - Customer Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2241 Release Date: ============= 2020-11-12 Vulnerability Laboratory ID VL-ID: ====================================...

Victor CMS suffers from SQL injection vulnerability (CNVD-2020-67387)

Victor CMS is a simple content management system. Victor CMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information about a database...

Octopus WAF - Web Application Firewall Made In C Language And Use Libevent

OctopusWAF is a open source Web application firewall, is made in C language uses libevent to make multiple connections. First step Instal lib-pcre, if you use RPM based distros search pcre-devel package, in BSD based search in ports or brew... Need libevent-dev, on RPM distros libevent-devel,...

SIGE (Joomla) 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities

Document Title: =============== SIGE Joomla 3.4.1 & 3.5.3 Pro - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2265 Release Date: ============= 2020-11-11 Vulnerability Laboratory ID VL-ID: ====================================...

Joomla SIGE 3.4.1-FREE / 3.5.3-PRO RFI / Cross Site Scripting

Title: SIGE - Simple Image Gallery Extended joomla extension 3.4.1-FREE / 3.5.3-PRO - Multi Vulnerability Remote File Inclusion RFI & Cross Site Scripting XSS date: 2020-11-11 Vendor Homepage: https://kubik-rubik.de/ Software Link: https://kubik-rubik.de/sige-simple-image-gallery-extended Softwar...

Customer Support System 1.0 Cross Site Scripting

Exploit Title: Customer Support System 1.0 - Stored XSS in The Admin Panel Date: 2020-11-11 Exploit Author: Ahmed Abbas Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html Software Link:...