SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
ArticleSetup Multiple Persistence Cross-Site Scripting and SQL Injection Vulnerabilities
CVE Research
ArticleSetup Multiple Persistence Cross-Site Scripting and SQL Injection Vulnerabilities
SecPod Research Team member (Antu Sanadi) has found Multiple Persistence Cross-Site Scripting and SQL Injection Vulnerabilities in ArticleSetup. The vulnerability is caused by improper validation of various parameters in multiple pages. This may allow an attacker to steal cookie-based authentication...
Netmechanica NetDecision Dashboard Server Information Disclosure Vulnerability
CVE Research
Netmechanica NetDecision Dashboard Server Information Disclosure Vulnerability
SecPod Research Team member (Prabhu S Angadi) has found Information Disclosure Vulnerability in Netmechanica NetDecision Dashboard Server. The vulnerability is caused due to improper validation of malicious HTTP requests to the Dashboard server appended with ‘?’ character, which discloses the Dashbo...
Adiscon LogAnalyzer ‘highlight’ Parameter Cross Site Scripting Vulnerability
CVE Research
Adiscon LogAnalyzer ‘highlight’ Parameter Cross Site Scripting Vulnerability
SecPod Research Team member (Sooraj K.S) has found Cross-Site Scripting Vulnerabilities in Adiscon LogAnalyzer. The vulnerability is caused by improper validation of “highlight” parameter in “index.php”. This may allow an attacker to steal cookie-based authentication credentials or inject arbitrary ...
AR Web Content Manager (AWCM) Cross-Site scripting Vulnerability
CVE Research
AR Web Content Manager (AWCM) Cross-Site scripting Vulnerability
SecPod Research Team member (Antu Sanadi) has found an XSS flaw in AR Web Content Manager (AWCM), which can be used to obtain sensitive information and launch further attacks. The flaw lies in the ‘search’ parameter in ‘search.php‘ while the application processes the user-supplied input and renders ...
PowerZip Insecure Library Loading Vulnerability
CVE Research
PowerZip Insecure Library Loading Vulnerability
Folks, SecPod Research Team member (Karthik N.) has found a DLL Insecure Loading vulnerability in PowerZip application, which can be used to call malicious arbitrary library files into the application context. For more details, please go though this below advisory link.
Metasploit Module – BisonFTP Server Remote Buffer Overflow Vulnerability
AT-TFTP Server v1.8 Remote Denial of Service Vulnerability
CVE Research
AT-TFTP Server v1.8 Remote Denial of Service Vulnerability
SecPod Research Team member (Antu Sanadi) has found a Denial of Service vulnerability in Allied Telesyn TFTP Server. The vulnerability is caused by an error in the “TFTPD.EXE”, which causes the server to crash when no acknowledgment response is sent back to the server after a successful ‘read’. The ...
Habari Installation Path Disclosure Vulnerability
MYRE Real Estate Software Multiple XSS and SQL Injection Vulnerabilities
CVE Research
MYRE Real Estate Software Multiple XSS and SQL Injection Vulnerabilities
SecPod Research Team member (Sooraj K.S) has found Multiple XSS and SQL Injection Vulnerabilities in MYRE Real Estate Software. The vulnerability is caused by improper validation of various parameters in several pages. This may allow an attacker to steal cookie-based authentication credentials, comp...