Beijing Jinhe C6 Collaborative Management Platform Arbitrary File Download Vulnerability

Jinhe OA is developed with asp.net and sqlserver technology and is used by many users. OA system/JHSoft.Web.CustomQuery/FileDownLoad.aspx page due to the FilePath parameter did not do ... /filter, can download any file in any directory, resulting in arbitrary file download vulnerability...

BizIdea Design CMS 2015Q3 SQL Injection Vulnerability

BizIdea Design CMS 2015Q3 suffers from a remote SQL injection vulnerability. Document Title: =============== bizidea Design CMS 2015Q3 - SQL Injection Vulnerability Product & Service Introduction: =============================== http://www.bizidea.co.th Technical Details & Description:...

Apple Support - Permission Exception Web Vulnerability

Document Title: =============== Apple Support - Permission Exception Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1531 Apple ID: 624514370 Release Date: ============= 2015-08-13 Vulnerability Laboratory ID VL-ID:...

Electric Sheep Fencing Pfsense 'zone' Parameter Cross-Site Scripting Vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing Pfsense that stems from the program's failure to adequately filter user-submitted input. When a us...

Apple iTunes U - Persistent POST Inject Web Vulnerability

Document Title: =============== Apple iTunes U - Persistent POST Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1532 Apple ID: 624515538 Release Date: ============= 2015-08-11 Vulnerability Laboratory ID VL-ID:...

Apple iTunes U - Persistent POST Inject Web Vulnerability

Document Title: =============== Apple iTunes U - Persistent POST Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1532 Apple ID: 624515538 Release Date: ============= 2015-08-11 Vulnerability Laboratory ID VL-ID:...

Acunetix Web Vulnerability Scanner 9.5 - Crash PoC Exploit

Exploit for windows platform in category dos / poc !/usr/bin/env python Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept Website : https://www.acunetix.com Tested : win 7 / win 8.1 / win vista Author : Hadi Zomorodi Monavar Email : email protected 1 . run python code : pyth...

Multiple Chiyu Products Cross-Site Scripting Vulnerabilities

Chiyu BF-630, BF-630W and BF-660C are all products of Chiyu.BF-630 and BF-630W are networked fingerprint access controllers.BF-660C is a networked fingerprint access control and time and attendance machine. A cross-site scripting vulnerability exists in multiple Chiyu products. A remote attacker...

Acunetix Web Vulnerability Scanner 9.5 - Crash (PoC)

Acunetix Web Vulnerability Scanner 9.5 - Crash PoC !/usr/bin/env python Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept Website : https://www.acunetix.com Tested : win 7 / win 8.1 / win vista Author : Hadi Zomorodi Monavar Email : [email protected] 1 . run python code...

Drupal OSF for Drupal module cross-site request forgery vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. A cross-site...

ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability

Document Title: =============== ThaiWeb CMS 2015Q3 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1555 Release Date: ============= 2015-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 1555...

Apple iTunes & AppStore - Persistent Invoice Vulnerability

Document Title: =============== Apple iTunes & AppStore - Persistent Invoice Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1512 Apple Security ID: 623920272 Video: http://www.vulnerability-lab.com/getcontent.php?id=1517 Vulnerability...

Moodle 'user/lib.php' Cross-Site Scripting Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in Moodle that stems from the program's...

Juniper Networks Junos J-Web Cross-Site Scripting Vulnerability

Juniper Networks Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in Juniper Networks Junos, which arises from the program's...

CVE-2015-2411

Microsoft Internet Explorer 10 and 11 are affected by memory corruption vulnerabilities described under CVE-2015-2411 (and related CVEs). The publicly documented details indicate that a crafted website can trigger remote code execution or a denial of service via memory corruption in IE’s handling...

CVE-2015-2404

Microsoft Internet Explorer (IE) versions 6–11 are affected by a memory corruption vulnerability exploitable via a crafted web page, potentially allowing remote code execution or memory corruption-driven denial of service. The CVE-2015-2404 entry is among a set addressed by MS15-065 (Cumulative S...

Simple Oekaki BBS vulnerability where arbitrary files may be deleted

Overview Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

IBM Jazz Team Server Cross-Site Scripting Vulnerability

IBM Jazz Team Server is a suite of project management tools for use in IBM Rational Jazz Team Collaboration Platform from IBM in the United States. A cross-site scripting vulnerability exists in IBM Jazz Team Server that stems from the program's failure to adequately filter user-submitted input...

Untangle NGFW HTML Injection Vulnerability

Untangle NGFW is a set of firewall platforms from the US company Untangle. The platform supports web filtering, virus blocking and spam blocking. An HTML injection vulnerability exists in Untangle NGFW. When a user browses an affected website, their browser will execute arbitrary HTML or script...

Chamilo LMS HTML Injection Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from an HTML injection vulnerability that stems fr...