LocalTapiola: Information exposure via error pages (www.lahitapiola.fi Tomcat)

Summary: Information exposure via error pages Description: Hello there! I take the risk that this report might be closed as a N/A but because you are running outdated tomcat I wanted to take this risk and report this to you. So here we go.. When you navigate to the page e.g...

SonicWall GMS 8.1 Filter Bypass / Input Validation

Document Title: =============== SonicWall GMS v8.1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1819 Release Notes:...

BA SYSTEMS BAS Web Information Disclosure Vulnerability in BAS920 and ISC2000 Devices

BAS920 and ISC2000 devices are both programmable intelligent controller products from BA SYSTEMS of Denmark.BA SYSTEMS BAS Web is a building automation system that runs on them. An access control error vulnerability exists in BA SYSTEMS BAS Web on BAS920 and ISC2000 devices using firmware version...

Photos in Wifi 1.0.1 iOS - Path Traversal Web Vulnerability

Document Title: =============== Photos in Wifi 1.0.1 iOS - Path Traversal Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1600 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5283 CVE-ID: ======= CVE-2018-5283 Release Date:...

Salesforce Force (EventRSVP) - Multiple Web Vulnerabilities

Document Title: =============== Salesforce Force EventRSVP - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2057 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID VL-ID: ====================================...

StivaSoft PHPJabbers Star Rating Script Cross-Site Scripting Vulnerability

StivaSoft PHPJabbers Star Rating Script is a set of online rating scripts from StivaSoft Bulgaria. A cross-site scripting vulnerability exists in StivaSoft PHPJabbers Star Rating Script. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via rating entries...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01397)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the amount parameter in the index.php?user=additiondeduction request...

FiyoCMS check_file.php file exists arbitrary file read hole

FiyoCMS is a content management system CMS for creating CMS templates. An arbitrary file read hole exists in the FiyoCMS checkfile.php file. An attacker can exploit the hole to read arbitrary files on the server...

Stored Cross-Site Scripting Vulnerability in HYBBS v2.0

HYBBS is a MVC-structured program based on HYPHP framework. A stored cross-site scripting vulnerability exists in HYBBS v2.0. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in user hijacking...

Multiple Cross-Site Scripting Vulnerabilities in Synology Chat

Synology Chat is an enterprise messaging service that runs on Synology NAS. The solution eliminates the need for users to compose emails and improves the efficiency of corporate communication. Multiple cross-site scripting vulnerabilities exist in Slash Command Creator in Synology Chat. A remote...

Red Hat CloudForms HTML Injection Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. The solution creates and manages private and public clouds and has the ability to manage the application lifecycle. An HTML injection vulnerability exists in Red Hat CloudForms, which stem...

PHP Scripts Mall Car Rental Script SQL Injection Vulnerability (CNVD-2018-00484)

PHP Scripts Mall Car Rental Script is an open source website script for cab booking owners and agents. PHP Scripts Mall Car Rental Script suffers from a SQL injection vulnerability. The vulnerability can be exploited to conduct SQL injection attacks via the carid parameter in admin/carlistedit.ph...

Reflective Cross-Site Scripting Vulnerability in TRS MAS infogate Plugin of Beijing Tops Information Technology Co.

TRS MAS is a universal media management system based on the characteristics of audio and video usage in the mobile Internet era. There is a reflective cross-site scripting vulnerability in the TRS MAS infogate plugin of Beijing Tops Information Technology Co. The vulnerability is due to the...

Ecava IntegraXor SQL Injection Vulnerability (CNVD-2017-37693)

Ecava IntegraXor is a toolset for creating and running human-machine interfaces for Web-based SCADA systems. Ecava IntegraXor suffers from a SQL injection vulnerability that can be exploited by an attacker to compromise an application, access or modify data, or exploit a potential vulnerability i...

The vulnerability of the “index.php” script in the microprogramming software for network storage devices from Western Digital MyCloud NAS allows for the execution of arbitrary commands.

The vulnerability of the “index.php” script in the microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially...

CVE-2017-17619

Laundry Booking Script 1.0 has SQL Injection via the /list city parameter...

CVE-2017-17615

Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter...

CVE-2017-17574

FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter...

Syhunt ScanTools 6.0 - Console Web Vulnerability Scan Tools

Syhunt ScanTools 6.0 adds advanced fingerprinting capabilities, enhanced spidering, injection and code scan capabilities, and a large number of improved checks. Adds the display of Hybrid, Dynamic and Code detailed scan statistics to the command-line tools. New fingerprinting capabilities - Becau...

CVE-2017-14186

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack...