CVE-2017-6704

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...

HUMAX Gateway Backup File Download Vulnerability

Humax HG100R devices are prone to a backup file download vulnerability. This file contains sensitive information which may lead to further attacks. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

niso.org XSS vulnerability

Vulnerable URL: http://www.niso.org/apps/grouppublic/projects.php?endinyear=1"...

WakaTime: Two email addresses can access the same account

Hello Team, When I was testing your web application I found that we can change the email address to a new email address. I tested that feature and noticed that after changing the email to a new email and then back to the old email, I can still access the account using both the email addresses...

skyhawkrugs.com XSS vulnerability

Vulnerable URL: http://skyhawkrugs.com/rugs.asp?collection=1"...

topnotchinc.com XSS vulnerability

Vulnerable URL: https://www.topnotchinc.com/docs/forms/employmentapp/application.asp?AttachedResume=No==1"...

WakaTime: Session not expired on logout

Description: Session management issue in https://wakatime.com Cookies are used to maintain session of the particular user and they should expire once the user logs out of his account.In secure web application,Cookies immediately expire once the user logs out of his account. But this is not...

SQL Injection Vulnerability in MallBuilder

MallBuilder is a multi-user online shopping mall solution based on PHP+MYSQL. MallBuilder suffers from a SQL injection vulnerability. An attacker can use this vulnerability to steal database information and control the operating system...

CVE-2017-6026

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization an...

CVE-2017-6028

An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials...

CVE-2017-6038

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...

Cross site request forgery (csrf)

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...

CVE-2017-6038

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request...

CVE-2017-6026

Affected products: Schneider Electric Modicon PLCs (M241 and M251) with firmware versions prior to 4.0.5.11. Root cause / vulnerability: Use of insufficiently random values in session numbers generated by the web application, leading to potential session compromise due to shared session identifie...

The likelihood of collaborative oa \app\team\block\control.php SQL injection

No description provided by source...

web.jns.ac.in XSS vulnerability

Vulnerable URL: http://web.jns.ac.in/login.asp?corner=1"...

secrestwardle.com XSS vulnerability

Vulnerable URL: http://www.secrestwardle.com/viewprofessional.php?practiceid=1"...

db.continentalcaststone.com XSS vulnerability

Vulnerable URL: http://db.continentalcaststone.com/Security/Login.asp?silent===/main.asp=1"...

Fixed Session Vulnerability in Sierra Wireless GX440

The Sierra Wireless GX440 is a gateway device from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless GX440 devices using version 4.3.2 of the ALEOS firmware. An attacker could exploit the vulnerability to access the management web application...

WordPress Ultimate Product Catalogue 4.2.2 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ultimate Product Catalogue 4.2.2 Sql Injection – Plugin WordPress – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/ Software Link:...