Moodle 'user/lib.php' Cross-Site Scripting Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in Moodle that stems from the program's...

Juniper Networks Junos J-Web Cross-Site Scripting Vulnerability

Juniper Networks Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. A cross-site scripting vulnerability exists in Juniper Networks Junos, which arises from the program's...

CVE-2015-2404

Microsoft Internet Explorer (IE) versions 6–11 are affected by a memory corruption vulnerability exploitable via a crafted web page, potentially allowing remote code execution or memory corruption-driven denial of service. The CVE-2015-2404 entry is among a set addressed by MS15-065 (Cumulative S...

CVE-2015-2411

Microsoft Internet Explorer 10 and 11 are affected by memory corruption vulnerabilities described under CVE-2015-2411 (and related CVEs). The publicly documented details indicate that a crafted website can trigger remote code execution or a denial of service via memory corruption in IE’s handling...

Simple Oekaki BBS vulnerability where arbitrary files may be deleted

Overview Simple Oekaki BBS provided by LEMON-S PHP contains a flaw in parsing the oekakis parameter in index.php, which may allow a remote attacker to delete arbitrary files. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

IBM Jazz Team Server Cross-Site Scripting Vulnerability

IBM Jazz Team Server is a suite of project management tools for use in IBM Rational Jazz Team Collaboration Platform from IBM in the United States. A cross-site scripting vulnerability exists in IBM Jazz Team Server that stems from the program's failure to adequately filter user-submitted input...

Untangle NGFW HTML Injection Vulnerability

Untangle NGFW is a set of firewall platforms from the US company Untangle. The platform supports web filtering, virus blocking and spam blocking. An HTML injection vulnerability exists in Untangle NGFW. When a user browses an affected website, their browser will execute arbitrary HTML or script...

Chamilo LMS HTML Injection Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from an HTML injection vulnerability that stems fr...

Chamilo LMS Cross-Site Scripting Vulnerability

Chamilo LMS is an open source online learning and collaboration system developed by the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. Chamilo LMS suffers from a cross-site scripting vulnerability that ste...

barnesandnoble.com XSS vulnerability

Vulnerable URL: http://www.barnesandnoble.com/mobile/noresults/%27%22%3Ev0raz%3Cbody/onpageshow=%22%26%2397lert%28'XSSPOSED'%29%22%3E Details: Description| Value ---|--- Patched:| Yes, at 24.01.2016 Latest check for patch:| 24.01.2016 12:27 GMT Vulnerability type:| XSS Vulnerability status:|...

shopNC B2B版SQL注入一枚

简要描述： 无需登录直接出数据 详细说明： 为了节省审核时间，先来五个实例 http://www.xiu365.cn/microshop/index.php?act=personal&classid0=exp&classid1=1%20or%20updatexml1,concat0x5c,user,1%23 http://www.xiu365.cn/microshop/index.php?act=personal&classid0=exp&classid1=1%20or%20updatexml1,concat0x5c,user,1%23...

Ebay Inc Magento Bug Bounty #16 - CSRF Web Vulnerability

Document Title: =============== Ebay Inc Magento Bug Bounty 16 - CSRF Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1472 Ebay Inc Security ID: EIBBP-31808 Release Date: ============= 2015-07-02 Vulnerability Laboratory ID VL-ID:...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

LimeSurvey SQL Injection Vulnerability (CNVD-2015-04153)

LimeSurvey formerly known as PHPSurveyor is a set of open source online survey program developed by the LimeSurvey team, which supports survey program development, questionnaire distribution and data collection. A SQL injection vulnerability exists in the insert function in the...

Synology DiskStation Manager Cross-Site Scripting Vulnerability

Synology DiskStation Manager is a web-based intuitive operating system that helps users manage files, photos, music, videos, and other important content stored on Synology DiskStation and RackStation. A cross-site scripting vulnerability exists in Synology DiskStation Manager, which allows remote...

BlackCat CMS 'logs.php' Arbitrary File Download Vulnerability

BlackCat CMS is a content management system based on PHP5 and HTML5. BlackCat CMS suffers from an input validation vulnerability that allows remote attackers to submit a special request to download arbitrary files...

php: regressions in 5.4+

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2015-03920)

Symphony CMS is a content management system CMS developed in PHP and MySQL. The system supports search engine optimization, module extensions and more. A cross-site scripting vulnerability exists in Symphony CMS version 2.6.2, which stems from the system/authors URI failing to adequately filter t...

ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability

Exploit for hardware platform in category web applications Document Title: =============== ZTE ZXV10 W300 v3.1.0cDR0 - UI Session Delete Vulnerability Product & Service Introduction: =============================== ZTE zxv10 w300 ADSL wireless router cat family gateway accessories include a host,...

ApPHP Hotel Site 3.x.x SQL Injection Vulnerability

ApPHP Hotel Site version 3.x.x suffers from a remote SQL injection vulnerability. Note that this finding houses site-specific data. ApPHP Hotel site SQLi Vulnerability ApPHP Hotel Site is an Hotel application programs using PHP Language. title : ApPHP Hotel Site v.3.x.x. godork : ".php?pid=" "ApP...