[CVE-2012-1002] OpenConf <= 4.11 (author/edit.php) Blind SQL Injection Vulnerability

-------------------------------------------------------------------- OpenConf = 4.11 author/edit.php Blind SQL Injection Vulnerability -------------------------------------------------------------------- author...............: Egidio Romano aka EgiX mail.................: n0b0d13satgmaildotcom...

CVE-2012-0995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...

PT-2012-3006

Name of the Vulnerable Software and Affected Versions OpenConf versions prior to 4.12 Description The issue allows remote attackers to execute arbitrary SQL commands via the pid parameter in the author/edit.php file. Recommendations For versions prior to 4.12, update to version 4.12 or later to...

CVE-2012-1002: Undefined Security Weakness

SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter...

PT-2012-2052

Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! versions prior to 3.65 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for...

PT-2011-5091

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue is related to the omission of the Content-Type header's charset parameter for certain resources, which could allow remote attackers to have an unspecified impact. This...

PT-2011-5083

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands by providing crafted input to a PHP script. This is demonstrated by...

PT-2011-5086

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue allows remote attackers to obtain potentially sensitive information via script access to cookies. This is because the HTTPOnly flag is not included in a Set-Cookie heade...

CMSmini 0.2.2 Local File Inclusion

Exploit Title: CMSmini 0.2.2 Local File Inclusion Date: 2011.10.20 Author: I2Sec5-BSK Software Link: http://sourceforge.net/projects/cmsmini/ Version: CMSmini 0.2.2 Tested on: Windows XP -------------------------------------------------- /admin/edit.php 30 $name = $GET'name'; 73 $filename =...

CMS mini 0.2.2 - Local File Inclusion

CMS mini 0.2.2 - Local File Inclusion Exploit Title: CMSmini 0.2.2 Local File Inclusion Date: 2011.10.20 Author: I2Sec5-BSK Software Link: http://sourceforge.net/projects/cmsmini/ Version: CMSmini 0.2.2 Tested on: Windows XP -------------------------------------------------- /admin/edit.php 30...

CMS mini 0.2.2 - Local File Inclusion

Exploit Title: CMSmini 0.2.2 Local File Inclusion Date: 2011.10.20 Author: I2Sec5-BSK Software Link: http://sourceforge.net/projects/cmsmini/ Version: CMSmini 0.2.2 Tested on: Windows XP -------------------------------------------------- /admin/edit.php 30 $name = $GET'name'; 73 $filename =...

CMSmini 0.2.2 Local File Inclusion

Exploit for php platform in category web applications Exploit Title: CMSmini 0.2.2 Local File Inclusion Date: 2011.10.20 Author: I2Sec5-BSK Software Link: http://sourceforge.net/projects/cmsmini/ Version: CMSmini 0.2.2 Tested on: Windows XP --------------------------------------------------...

CVE-2011-3371

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

CVE-2011-3371

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

CVE-2011-3371: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 id, 2 formsent, 3 csrftoken, 4 reqconfirm, or 5 delete parameter to delete.php, the 6 id, 7 formsent, 8 csrftoken, 9 reqmessage,...

PT-2011-4411

Name of the Vulnerable Software and Affected Versions PunBB versions prior to 1.3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters to different PHP files, including delete.php, edit.php, login.php, misc.php, profile.php, and register.ph...

Toko Lite CMS 1.5.2 HTTP Response Splitting

Toko Lite CMS 1.5.2 edit.php HTTP Response Splitting Vulnerability Vendor: Toko Product web page: http://toko-contenteditor.pageil.net Affected version: 1.5.2 Summary: Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advance...

Toko Lite CMS 1.5.2 - 'edit.php' HTTP Response Splitting

Toko Lite CMS 1.5.2 edit.php HTTP Response Splitting Vulnerability Vendor: Toko Product web page: http://toko-contenteditor.pageil.net Affected version: 1.5.2 Summary: Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advance...

Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability

Exploit for php platform in category web applications Toko Lite CMS 1.5.2 edit.php HTTP Response Splitting Vulnerability Vendor: Toko Product web page: http://toko-contenteditor.pageil.net Affected version: 1.5.2 Summary: Toko Web Content Editor cms is a compact, multi language, open source web...

encoder 0.4.10 - edit.php Cross-Site Scripting

encoder 0.4.10 - edit.php Cross-Site Scripting source: https://www.securityfocus.com/bid/47755/info encoder is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...