EditMe CMS - CSRF Privilege Escalate Web Vulnerability

Document Title: =============== EditMe CMS - CSRF Privilege Escalate Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1996 Release Date: ============= 2016-11-14 Vulnerability Laboratory ID VL-ID: ==================================== 19...

CG-WLR300NX vulnerable to cross-site scripting

Overview CG-WLR300NX provided by Corega Inc is a wireless LAN router. CG-WLR300NX contains a cross-site scripting vulnerability CWE-79. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

Dedecms CSRF Vulnerability

Dedecms is an open source PHP open source website management system. Dedecms has a CSRF vulnerability that allows an attacker to exploit the vulnerability to perform unauthorized operations as an administrator and delete the account of any user...

Schoolhos CMS 2.29 - 'kelas' SQL Injection

Document Title: =============== Schoolhos CMS v2.29 - kelas Data Siswa SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1931 Release Date: ============= 2016-11-07 Vulnerability Laboratory ID VL-ID:...

Exponent CMS SQL Injection Vulnerability (CNVD-2016-10699)

Exponent CMS is a free, open source PHP-based modular content management system CMS of the U.S. OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability exists in th...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09989)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-17 Vulnerability Laboratory ID VL-ID: ==================================== 1980...

Pluck 4.7.3 - (Delete Files) CSRF Vulnerability

Exploit for php platform in category web applications Document Title: =============== Pluck 4.7.3 - Delete Files CSRF Vulnerability Release Date: ============= 2016-10-12 Vulnerability Disclosure Timeline: ================================== 2016-10-12 : Discovery of the Vulnerability 2016-10-12 :...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1980...

CVE-2016-3385

CVE-2016-3385 concerns the Microsoft Internet Explorer scripting engine (IE9–IE11) memory corruption vulnerability. A remote attacker can exploit it by tricking a user to visit a crafted website, potentially gaining arbitrary code execution or causing a memory corruption Denial of Service. The CV...

Stored Cross-Site Scripting Vulnerability in 50CMS V3.0

50CMS is an open source content management system for software developers, program enthusiasts, and web designers. A stored cross-site scripting vulnerability exists in 50CMS V3.0. Due to the lack of security filtering of form inputs, an attacker can exploit the vulnerability to write arbitrary...

PYSEC-2016-3

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

IBM Connections Cross-Site Scripting Vulnerability (CNVD-2016-08267)

IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. A cross-site scripting...

FreePBX Remote Command Execution Vulnerability (CNVD-2016-08542)

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A remote command execution vulnerability exists in the FreePBX 'admin/modules/hotelwakeup/Hotelwakeup.class.php...

WordPress InfiniteWP Admin Panel Authentication Bypass Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authentication bypass vulnerability exists in the WordPress InfiniteWP Admin Panel. Because app/php does n...

The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code

The vulnerability of the Internet Explorer browser is related to errors in its code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely or cause a service failure memory corruption by using a specially crafted web page...

SQL Injection Vulnerability in ID Parameters of Dynamic Easy Network Campus System

Dynamic easy network campus system is based on the actual application needs of customers in the education industry Dynamic easy to provide a complete set of school website application solutions, set "home-school interaction, knowledge sharing, teaching aids," in one, to assist the school website ...

Microsoft Internet Explorer Memory Corruption Vulnerability (CNVD-2016-07594)

Microsoft Internet Explorer is a popular WEB browser. A memory corruption vulnerability exists in Microsoft Internet Explorer that can be exploited by a remote attacker to construct a malicious web page that can be parsed by a user to execute arbitrary code in the context of the application...

Yelp: Clickjacking: X-Frame Header Missing

Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their...

CVE-2016-3375

The CVE-2016-3375 entry describes a memory-corruption vulnerability in the Microsoft OLE Automation mechanism and VBScript Scripting Engine used by Internet Explorer. A remote attacker can craft a website to trigger memory corruption, potentially executing arbitrary code in the context of the log...