Simple Web Content Management System 1.1 SQL Injection

Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 Discovered by: loneferret Side note: This application is nothing fancy, a...

Symantec Web Gateway 5.0.2 - Local/Remote File Inclusion / Remote Code Execution

!/usr/bin/python Symantec Web Gateway 5.0.2 Remote LFI root Exploit Proof of Concept Exploit requires no authentication, /tmp/networkScript is sudoable and apache writable. muts at offensive-security dot com import socket import base64 payload= '''echo '!/bin/bash' /tmp/networkScript; echo 'bash ...

http-icloud-findmyiphone NSE Script

Retrieves the locations of all "Find my iPhone" enabled iOS devices by querying the MobileMe web service authentication required. Script Arguments http-icloud-findmyiphone.username the Apple Id username http-icloud-findmyiphone.password the Apple Id password slaxml.debug See the documentation for...

Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability [CVE-2012-1417]

============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage:...

Yealink VOIP Phone - Persistent Cross-Site Scripting

Yealink VOIP Phone - Persistent Cross-Site Scripting ============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting...

Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability

Exploit for hardware platform in category web applications Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage: http://www.yealink.com/ Impact: Medium Authentication: Required CVE: CVE-2012-1417 Found: 2012-02-21 Author: Narendra Shind...

Yealink VOIP Phone - Persistent Cross-Site Scripting

============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage:...

(0Day) HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP MSA 2000 G3. Authentication is not required to exploit this vulnerability. The specific flaws exists within the web interface listening on TCP port 80. There exists a directory traversal flaw th...

HP Managed Printing Administration img_id Multiple Vulnerabilities

This vulnerability allows remote attackers to remotely manipulate the application database and delete arbitrary files on vulnerable installations of HP Managed Printing Administration. Authentication is not required to exploit this vulnerability. The specific flaw exists and is duplicated within...

Symantec IM Manager IMAdminLDAPConfig.asp SQL injection

Added: 10/31/2011 CVE: CVE-2011-0553 BID: 49738 OSVDB: 75984 Background Symantec IM Manager is a solution for managing and securing instant-messaging traffic in an enterprise. Problem An SQL injection vulnerability in IMAdminLDAPConfig.asp allows remote, authenticated attackers to execute arbitra...

Novell Cloud Manager Insufficient Framework User Validation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Cloud Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within how the application implements an RPC method. Due to incompletely initializing an...

ManageEngine ServiceDesk Plus 8.0 Build 8013 - Multiple Cross-Site Scripting Vulnerabilities

ManageEngine ServiceDesk Plus 8.0 Build 8013 - Multiple Cross-Site Scripting Vulnerabilities ======================================================================= Secur-I Research Group Security Advisory SV-2011-003 ======================================================================= Title:...

OpenX Ad Server 2.8.7 - Cross-Site Request Forgery

OpenX Ad Server 2.8.7 - Cross-Site Request Forgery Secur-I Research Group Security Advisory ======================================================================= Title: OpenX Ad Server CSRF Vulnerability Product: OpenX Ad Server Vulnerable version: 2.8.7 and probably earlier versions Fixed...

Symantec Endpoint Protection File Overwrite

SUMMARY Symantec Endpoint Protection SEP Manager reporting module allows a php file overwrite from an authorized client that could potentially allow execution of arbitrary code on the server-side. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Endpoint Protection | 11.x |...

Symantec IM Manager Administrative Interface SummaryReportGroup.lgx Definition File SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx page which is exposed through an IIS extension on the defau...

IBM DB2 install_jar Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is required in that a user must have the ability to connect to the database. The specific flaw exists within the installjar procedure. The installjar procedure contains a...

Micro CMS v1.0 b1 Persistent XSS Vulnerability

Exploit for php platform in category web applications ============================================== Micro CMS v1.0 b1 Persistent XSS Vulnerability ============================================== Class: Persistent Cross-Site Scripting Severity: High Overview: --------- Micro CMS is prone to...

MVSA-10-007 / CVE-2010-0152 - IBM Proventia Mail Security System - Multiple persistent and reflected XSS vulnerabilities

Security Advisory: MVSA-10-007 / CVE-2010-0152 Vendor: IBM Products: Proventia Network Mail Security System Vulnerabilities: Multiple Cross-Site Scripting XSS Risk: High Attack Vector: From Remote Authentication: Not Required/Required Reference:...

RJ-iTop Network Vulnerability Scanner System - Multiple SQL Injections

RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities Vulnerable: v3.0.7.x Vendor: www.rj-itop.com Category: Input Validation Error Impact: SQL injection Details: ========= Multiple SQL Injection Vulnerabilities has been found in DRJ-iTop Network Vulnerability Scanne...

Symantec IM Manager Local-Access Cross-site Scripting

SUMMARY Symantecs IM Manager management console is susceptible to a cross-site scripting issue. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- Symantec IM Manager | 8.3 and 8.4 | Upgrade to 8.4.13 Note: Customers running 8.3 versions of Symantec IM Manager should upgrade to the lates...