The SySS GmbH found out that the web application perfact:mpa accepts user-controlled input via the URL parameter “redir” that can be used to redirect victims to an arbitrary site which…

The SySS GmbH found out that different resources of the web application perfact::mpa can be directly accessed by the correct URL due to improper user authorization checks. That is, unauthorized…

The SySS GmbH found out that different functions of the web application perfact::mpa are prone to persistent cross-site scripting attacks due to insufficient user input validation.

WordPress GravityForms plugin version 1.9.15.11 suffers from a cross site scripting vulnerability.

Inserting an HTML ‘script’ tag into the URL of a web site protected by Sophos UTM 525 yields an error page which contains the ‘script’ tag unfiltered. Executing malicious JavaScript…

em4 soft suffers from a division by zero attack when handling Crouzet Logic Software Document ‘.pm4’ files, resulting in denial of service vulnerability and possibly loss of data.

em4 soft and M3 soft both suffer from a privilege escalation vulnerability. Executables can be changed by an authenticated user due to improper permissions.

Microsoft PowerPoint Viewer version 12.0.6600.1000 suffers from a DLL hijacking vulnerability.

This Metasploit module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrators interface where they…