LFI, IAA, XSS и FPD уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Local File Inclusion, Insufficient Anti-automation, Cross-Site Scripting и Full path disclosure уязвимостях в W-Agora. Local File Inclusion WASC-31: http://site/register.php?bn=1 в папке conf http://site/register.php?bn=..1 в любой папке - только ...

W-Agora 4.2.1 Cross Site Scripting / Local File Inclusion

Hello list! I want to warn you about Cross-Site Scripting, Local File Inclusion and Brute Force vulnerabilities in W-Agora. SecurityVulns ID: 11499. ------------------------- Affected products: ------------------------- Vulnerable are W-Agora 4.2.1 and previous versions. ---------- Details:...

XSS, LFI и BT уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Local File Inclusion и Brute Force уязвимостях в W-Agora. XSS WASC-08: http://site/current/getfile.php/supporthowto/223E3Cbody20onload=alertdocument.cookie3E/1/ Local File Inclusion WASC-31: В папке conf:...

W-Agora 4.2.1 Cross Site Scripting / Denial Of Service / SQL Injection

Hello Packet Storm! I want to warn you about Cross-Site Scripting, SQL DB Structure Extraction, SQL Injection and Denial of Service vulnerabilities in W-Agora. SecurityVulns ID: 11324. ------------------------- Affected products: ------------------------- Vulnerable are W-Agora 4.2.1 and previous...

Ross Klein (Starwood Hotels and Resorts Worldwide)

Klein and Amar Lalvani were two top executives at the Starwood hotel chain when they were recruited by Starwood’s chief competitor, Hilton, to help it start a new line of “lifestyle” hotels to compete with Starwood’s popular “W” hotels. According to a lawsuit filed by Starwood, the two executives...

Многочисленные уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною многочисленных Cross-Site Scripting, SQL DB Structure Extraction, SQL Injection и Denial of Service уязвимостях в W-Agora. XSS WASC-08:...

W-Agora 4.2.1 Cross Site Scripting / Local File Inclusion

Hello Full-Disclosure! I want to warn you about new Cross-Site Scripting and Local File Inclusion vulnerabilities in W-Agora. ------------------------- Affected products: ------------------------- Vulnerable are W-Agora 4.2.1 and previous versions. ---------- Details: ---------- XSS WASC-08:...

Новые уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Cross-Site Scripting и Local File Inclusion уязвимостях в W-Agora. XSS WASC-08: http://site/news/for-print.php3?bn=x&key=12828507193Cscript3Ealertdocument.cookie3C/script3E...

W-Agora 4.1.5 - Local File Inclusion Cross-Site Scripting

W-Agora 4.1.5 - Local File Inclusion Cross-Site Scripting source: https://www.securityfocus.com/bid/44507/info W-Agora is prone to multiple local file-include vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker c...

W-Agora 4.1.5 - Local File Inclusion / Cross-Site Scripting

source: https://www.securityfocus.com/bid/44507/info W-Agora is prone to multiple local file-include vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to view and execute local...

w-Agora 'search.php' Local File Include and Cross Site Scripting Vulnerabilities

w-Agora is prone to a local file-include vulnerability and a cross- site scripting vulnerability because it fails to properly sanitize user- supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the...

W-Agora 'search.php' LFi and XSS Vulnerabilities

w-Agora is prone to a local file-include LFi vulnerability and a cross-site scripting XSS vulnerability because it fails to properly sanitize user-supplied input. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

Уязвимости в W-Agora

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting и Local File Inclusion уязвимостях в W-Agora. XSS WASC-08: http://site/news/search.php3?bn=3Cbody20onload=alertdocument.cookie3E Local File Inclusion WASC-31: Можно инклюдить php-файлы с расширением php3 в версии W-Agora 4.1.5...

W-Agora 4.2.1 Cross Site Scripting / Local File Inclusion

Hello Full-Disclosure! I want to warn you about Cross-Site Scripting and Local File Inclusion vulnerabilities in W-Agora. In addition to vulnerabilities in this system which I found and disclosed in 2006 SecurityVulns ID: 6960. ------------------------- Affected products: ------------------------...

W-Agora 4.2.1 - 'search.php3?bn' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/44370/info w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal...

W-Agora 4.2.1 - 'search.php?bn' Cross-Site Scripting

source: https://www.securityfocus.com/bid/44370/info w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal...

W-Agora 4.2.1 - search.php?bn Cross-Site Scripting

W-Agora 4.2.1 - search.php?bn Cross-Site Scripting source: https://www.securityfocus.com/bid/44370/info w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local...

W-Agora 4.2.1 - search.php3?bn Traversal Local File Inclusion

W-Agora 4.2.1 - search.php3?bn Traversal Local File Inclusion source: https://www.securityfocus.com/bid/44370/info w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the...

CVE-2009-4134

Removed by vendor...

Unfixed XSS vulnerability at w-irc.com

Security researcher Mystick, has submitted on 24/05/2010 a cross-site-scripting XSS vulnerability affecting w-irc.com, which at the time of submission ranked 3994702 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/07/2010. It is currently...