UBUNTU-CVE-2017-7459

ntopng before 3.0 allows HTTP Response Splitting...

SAP BusinessObjects Financial Consolidation Cross-Site Scripting Vulnerability (CNVD-2017-14353)

The SAP BusinessObjects portfolio offers a wide range of business intelligence software, information management software, enterprise performance management solutions, and regulatory, risk, and compliance solutions. financial Consolidation is an enterprise performance management product. A...

File Upload Vulnerability in FinecmsV5.0.8

FineCMS is a content management system based on PHP+MySql. A file upload vulnerability exists in Finecms V5.0.8, which exists in the file finecms\dayrui\controllers\Api.php. An attacker can exploit the vulnerability to upload arbitrary files...

Catfish CMS is vulnerable to XSS

Catfish Catfish CMS is an open source PHP CMS web content management system. catfish cms there is an XSS vulnerability, the reason for this vulnerability is not filtered user-submitted data due to the attacker can exploit the vulnerability to implant cross-site code to obtain sensitive informatio...

Code execution vulnerability in finecms

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework. A code execution vulnerability exists in finecms. An attacker can exploit the vulnerability getshell...

OV3 Online Administration Remote Code Execution Vulnerability

OV3 Online Administration is an online administration platform. A remote code execution vulnerability exists in OV3 Online Administration. The vulnerability is due to the validation of an uploaded file in the 'imageeditor.php' script via the 'userfile' POST parameter. This allows an attacker to...

123ContactForm - Cross Site Scripting Web Vulnerability

Document Title: =============== 123ContactForm - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1982 Ref: 123-1476631846 Release Date: ============= 2017-06-12 Vulnerability Laboratory ID VL-ID:...

123ContactForm - Cross Site Scripting Web Vulnerability

Document Title: =============== 123ContactForm - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1982 Ref: 123-1476631846 Release Date: ============= 2017-06-11 Vulnerability Laboratory ID VL-ID:...

Craft CMS 2.6 Cross Site Scripting / File Upload

Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Tested on: Kali Linux 2.0 | Windows 8.1...

Tiki Wiki CMS Groupware cross-site scripting vulnerability (CNVD-2017-11651)

Tiki Wiki CMS Groupware is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in the...

Acunetix Web Vulnerability Scanner Local Elevation of Privilege Vulnerability

Acunetix Web Vulnerability Scanner is a WEB vulnerability scanning tool. Acunetix Web Vulnerability Scanner suffers from an elevation of privilege vulnerability, which can be exploited by a local attacker to elevate privileges...

SQL injection vulnerability in OA system welcomeShow.aspx page mode parameter of Guangzhou Hongfan Computer Technology Co.

Red sail iOffice system is a based on Microsoft .NET technology research and development, the establishment of notebook, cell phone and other convenient terminal as a carrier to realize the mobile information system. ioffice OA system involves hospitals, government, military industry, group...

S-CMS v3.0 build20170522 exists foreground arbitrary user password reset vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS v3.0 build20170522 /member/membersetpwd.asp page exists in the foreground any user password reset vulnerability, allowing an attacker to use the vulnerability to reset the foreground any user...

Lufthansa AG - (Limbo) Open Redirect Web Vulnerability

Document Title: =============== Lufthansa AG - Limbo Open Redirect Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2060 LHPROD-66558 COM-1036050 Release Date: ============= 2017-05-23 Vulnerability Laboratory ID VL-ID:...

Zomato: CSRF To Like/Unlike Photos

Description: There is a CSRF vulnerability allowing an attacker to trick a user into visiting his/her site and to forge a request to zomato.com that will in turn like or unlike the photos of the attacker's choosing. The vulnerable page is https://www.zomato.com/php/photoViewerActionsHandler.php ,...

Lufthansa AG - (Limbo) Open Redirect Web Vulnerability

Document Title: =============== Lufthansa AG - Limbo Open Redirect Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2060 LHPROD-66558 COM-1036050 Release Date: ============= 2017-05-22 Vulnerability Laboratory ID VL-ID:...

IBM Rational Team Concert HTML Injection Vulnerability (CNVD-2017-10396 )

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. An HTML injection vulnerability exists in IBM RTC. A remote attacker could exploit this vulnerability by...

Design/Logic Flaw

An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...

Super File Explorer 1.0.1 Arbitrary File Upload

Document Title: =============== Super File Explorer 1.0.1 - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2034 Release Date: ============= 2017-02-23 Vulnerability Laboratory ID VL-ID:...

Stanford University (MBC) - SQL Injection Web Vulnerability

Document Title: =============== Stanford University MBC - SQL Injection Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2004 ID: INC000003888376 Release Date: ============= 2017-05-03 Vulnerability Laboratory ID VL-ID:...