2521 matches found
F3Site <= 2.1 - Remote Code Execution Exploit
No description provided by source. ? // //Kacper & str0ke Settings $exploitname = F3Site = 2.1 Remote Code Execution Exploit; $scriptname = F3Site 2.1; $scriptsite = http://dhost.info/compmaster/; $dork = 'Powered by F3Site'; //to work exploit you need admin session, and cookies prefix // print '...
Invision Power Services Invision Board 2.1 admin.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15344/info Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issu...
Emek Portal 2.1 Uyegiris.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20378/info Emek Portal is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...
RedHat Linux 2.1 abuse.console Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/354/info Abuse is a game that is included with RedHat Linux 2.1 in the games package. The console version, abuse.console, is suid-root and will load the program sndrv as root without checking for an absolute pathname. Thi...
CVE-2013-1397
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the 1 Yaml::parse or 2 Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348...
CVE-2014-2604
Unspecified vulnerability in HP IceWall SSO 10.0 Dfw and IceWall MCRP 2.1 and 3.0 allows remote attackers to cause a denial of service via unknown vectors...
Design/Logic Flaw
NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service "remote control" outage by creating a /tmp/Mosaic.pid file for every possible PID...
Lavarel-Security XSS Filter Bypass Vulnerability
Lavarel-Security cross site scripting filter suffers from a bypass vulnerability. Product: Lavarel-Security XSS Filter Bypass Vulnerability: Mutation Based XSS Bypass Impact: Medium/High Authors: Rafay Baloch Company: RHAinfoSEC Website: http://rhainfosec.com Status: Fixed ========= Description...
CVE-2013-6369
Stack-based buffer overflow in the jbgdecin function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted image file...
SA-CONTRIB-2014-037 - BlueMasters - Cross Site Scripting
Bluemasters is a responsive layout theme for Drupal 7. The Bluemasters theme does not properly sanitize theme settings before they are used in the output of a page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer themes". CVE identifie...
Veryide 2.1 /library.php SQL注入漏洞
No description provided by source...
PYSEC-2014-54
Multiple cross-site scripting XSS vulnerabilities in 1 spamProtect.py, 2 pts.py, and 3 request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
PYSEC-2014-52
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors related to "retrieving information for certain resources."...
CVE-2013-4198
mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality...
CVE-2013-4199
1 cbdecode.py and 2 linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service resource consumption via a large zip archive, which is expanded decompressed...
Thinksaas最新版注入无视GPC
简要描述： thinksaas最新版2.1某处sql注入修补不完善，继续注入。 详细说明： Thinksaas是一款轻量级开源社区系统，界面我很喜欢。官网在http://www.thinksaas.cn/。 说到无视GPC，大家想到什么。Get、Post、Cookie请求不好用的时候，还能用到什么？ 当然是SERVER或FILE。 这个cms在全局文件中使用了addslashes对GET、POST、COOKIE进行了过滤，而且在操作数据库的函数中，在where的位置又用了mysqlrealescapestring，所以使得游戏变得很难。...
ODude Ecard - DT
ODude Ecard - DT - 777 developer statement - ODude Ecard Version 2.1 http://www.odude.com/main/odude-ecard/ecard-log.html...
pfSense 2.1 build 20130911-1816目录遍历漏洞
No description provided by source. Proof of Concept 1 : Arbitrary File Inclusion ====================================================================== GET /snort/snortlogview.php?logfile=/etc/passwd HTTP/1.1 Host: firewall1.pentestlab1:1337 Connection: keep-alive Accept:...
CVE-2013-4200
The isURLInPortal method in the URLTool class in inportal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allowexternalloginsites filtering property, redirect users to...
CVE-2013-7020
The readheader function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted FFV1 data...