PHP-Nuke 7.0 / 8.1 / 8.1.35 Wormable Remote Code Execution

!/usr/bin/php ?php / Wormable Remote Code Execution in PHP-Nuke 7.0/8.1/8.1.35newist as of release Vendor's Website:http://phpnuke.org/ Secuirty Researcher: Michael Brooks https://sitewat.ch Original Advisory: http://blog.sitewat.ch/2010/05/vulnerabilities-in-php-nuke.html Google hack: "Francisco...

Vulnerability in Referer for DataLife Engine

Hello Bugtraq! I want to warn you about security vulnerability in Referer module for DataLife Engine DLE. ----------------------------- Advisory: Vulnerability in Referer for DataLife Engine ----------------------------- URL: http://websecurity.com.ua/3942/ ----------------------------- Affected...

DataLife Engine 6.9 Cross Site Scripting

Hello Bugtraq! I want to warn you about security vulnerability in Referer module for DataLife Engine DLE. ----------------------------- Advisory: Vulnerability in Referer for DataLife Engine ----------------------------- URL: http://websecurity.com.ua/3942/ ----------------------------- Affected...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to 1 admin/adminconfig.php, 2 admin/adminmodules.php, 3 delete.php, 4 editlink.php, 5 submit.php, 6 submitgroups.php, 7...

CVE-2009-4788

Multiple open redirect vulnerabilities in Pligg 1.0.2 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the 1 return parameter to pligg/login.php and the 2 HTTP Referer header to usersettings.php...

CVE-2009-4786

Multiple cross-site scripting XSS vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to 1 admin/adminconfig.php, 2 admin/adminmodules.php, 3 delete.php, 4 editlink.php, 5 submit.php, 6 submitgroups.php, 7...

Atlassian JIRA 500page.jsp Referer XSS

"The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting XSS vulnerability in the 500page.jsp file due to an HTTP 'referer' field not being properly sanitized before being displayed in the page. A remote attacker can exploit this, by tricking a user...

Discuz! Cross Site Scripting

hi; All versions of Discuz! have the cross-site vulnerabilities because of the export value of "$referer". Like: Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X and so on. There are some htm pages in all versions of Discuz!, that are: /templates/default/attachpay.htm /templates/default/ecrate.h...

Discuz! "$referer"输出值跨站漏洞

在Discuz! 任意版本中存在以下页面： /templates/default/attachpay.htm /templates/default/ecrate.htm /templates/default/register.htm 这些页面都包含$referer输出代码： input type="hidden" name="referer" value="$referer" / 当$referer 中含有恶意代码时，这些页面及被其嵌套的php页面会产生跨站漏洞。 Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X...

"$referer" export lead to the cross-site flaws in all versions of Discuz!

hi; All versions of Discuz! have the cross-site vulnerabilities because of the export value of "$referer". Like: Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X and so on. There are some htm pages in all versions of Discuz!, that are: /templates/default/attachpay.htm /templates/default/ecrate.h...

Harris Stratex StarMAX crossite request forgery

Referer for GET request is not checked...

Abo CMS <= 5.4 remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =================================================== Abo CMS = 5.4 remote SQL Injection Vulnerabilities =================================================== Author: Vladimir Vorontsov OnSec Russian Security Group In the popular content...

CVE-2009-4717

Multiple cross-site scripting XSS vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the 1 host parameter to stat/host.php, nodayshow parameter to 2 mostvisitpage.php and 3 visitorduration.php in stat/, 4 nopagesmost parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the 1 host parameter to stat/host.php, nodayshow parameter to 2 mostvisitpage.php and 3 visitorduration.php in stat/, 4 nopagesmost parameter to...

CVE-2009-4717

Multiple cross-site scripting XSS vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the 1 host parameter to stat/host.php, nodayshow parameter to 2 mostvisitpage.php and 3 visitorduration.php in stat/, 4 nopagesmost parameter to...

CVE-2010-0921

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0920

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to inject arbitrary web script or HTML via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0921

Cross-site request forgery CSRF vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 229.281 for Domino 8.0.2 FP4 allows remote attackers to hijack the authentication of unspecified victims via vectors related to lack of "XSS/CSRF Get Filter and Referer Check fixes."...

CVE-2010-0921

IBM Lotus iNotes (aka Domino Web Access) prior to 229.281 for Domino 8.0.2 FP4 is affected by a CSRF vulnerability that could allow an attacker to hijack the authentication of unspecified victims due to missing XSS/CSRF Get Filter and Referer Check fixes. Affected component: iNotes/DWA on Domino ...