PT-2012-5949

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Thunderbird versions prior to 16.0 SeaMonkey versions prior to 2.13 Description The issue arises from improper handling of navigation away from a web page with multiple active menus of SELECT elements,...

Tech-ex 6. x - 7.06 SQL injection vulnerability-vulnerability warning-the black bar safety net

Author:my5t3ry Reprinted please specify: t00ls. The vulnerability is located in the registration page\User\Reg\RegAjax. asp 2 4 - 4 6-row and 2 5 4 -270 lines of code as follows: Code omitted.... and The above code in the Province=UnEscapeKS. S"Province" call a custom function KS. S were filtered...

CVE-2012-1652

Cross-site scripting XSS vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."...

Cross site scripting

Cross-site scripting XSS vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."...

CVE-2012-1652

Cross-site scripting XSS vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."...

CVE-2012-1652

The CVE-2012-1652 affects the Drupal contributed module Hierarchical Select (6.x-3.x) prior to 6.x-3.8. It is a Cross-Site Scripting (XSS) vulnerability caused by unsanitized data in vocabulary help text exposed to remote authenticated users with administer taxonomy permissions. The impact is tha...

CVE-2012-1652

Cross-site scripting XSS vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."...

PT-2012-3416

Name of the Vulnerable Software and Affected Versions Drupal Hierarchical Select module versions 6.x-3.x before 6.x-3.8 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via...

CVE-2012-1652: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."...

CVE-2012-1660: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select or other" module is enabled, allow remote authenticated users with the create webform content permission to inject...

PT-2012-3086

Name of the Vulnerable Software and Affected Versions Open-Realty CMS versions 2.5.8 and earlier Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the select users template parameter to the...

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a...

PT-2012-4733

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.0 through 3.0.16 Ruby on Rails versions 3.1.0 through 3.1.7 Ruby on Rails versions 3.2.0 through 3.2.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via t...

WordPress Plugin Mz-jajak 2.1 - SQL Injection

Exploit Title: WordPress Mz-jajak plugin query"UPDATE " . $tablename . " SET ".$answert."=".$answert."+1 WHERE id=".$id; $rows = $wpdb-getresults"SELECT FROM " . $tablename . " WHERE id=".$id; Greetz: T0r3x, m1l05, JuMp-Er, EsC, UNICORN, Xermes, s4r4d0...

pBot - Remote Code Execution

!/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions Tested on: Linux 3.2 use...

pBot Remote Code Execution

!/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions Tested on: Linux 3.2 use...

eNdonesia 8.5 diskusi Module SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: eNdonesia 8.5 diskusi Module SQL Injection Vulnerability Google Dork: intext:powered by endonesia 8.5 Date: 07/28/2012 Author: Crim3R download Link :...

Unbreakable Enterprise kernel Security update

2.6.32-300.29.2 - epoll: epollwait should not use timespecaddns Eric Dumazet - epoll: clear the tfilechecklist on -ELOOP Joe Jin CVE-2012-3375 - Don't limit non-nested epoll paths Jason Baron - epoll: kabi fixups for epoll limit wakeup paths Joe Jin CVE-2011-1083 - epoll: limit paths Jason Baron...

SN News 1.2 - 'visualiza.php' SQL Injection

\n"; echo "Example:\n"; echo "php $argv0 http://www.website.com/snnews\n"; exit; $target = $argv1; ifsubstr$target, strlen$target-1!="/" $target .= "/"; $inject = $target . "visualiza.php?id=-0'%20"; $token = uniqid; $tokenhex = hex$token; echo " Trying to get informations...\n"; $infos =...

CVE-2012-0805

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the 1 limit or 2 offset keyword to the select function, or unspecified vectors to the 3 select.limit or 4 select.offset function...