CMS Made Simple < 2.2.10 - SQL Injection Exploit

Exploit for php platform in category web applications !/usr/bin/env python Exploit Title: Unauthenticated SQL Injection on CMS Made Simple = 2.2.9 Exploit Author: Daniele Scanu @ Certimeter Group Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can...

DEBIAN-CVE-2018-1000078

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting XSS vulnerability in gem server display of homepage attribute that can...

CVE-2018-1000075

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can...

Wireshark Security Updates (wnpa-sec-2017-43_wnpa-sec-2017-42) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

Wireshark Denial of Service Vulnerability (CNVD-2017-30503)

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in Wireshark versions 2.4.0 through 2.4.1 and 2.2.0...

Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.2.9, which fixes a few security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details...

CVE-2015-1555

Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators...

ASPCMS 2.2.9 /inc/AspCms_Visits.asp SQL注入漏洞

ASPCMS是国内一款非常流行的CMS 建站系统，其2.2.9版本/inc/AspCmsVisits.asp文件中在该文件的行 6 将ContentID直接拼接到了注入语句，从而导致sql注入漏洞。 ASPCMS 2.2.9...

AspCms 2.2.9 /inc/AspCms_CommonFun.asp 登录绕过漏洞

ASPCMS是国内一款非常流行的CMS 建站系统，其2.2.9版本inc/AspCmsCommonFun.asp文件，在问题函数checkLogin中， line 1152:只检测了从cookie取出的adminName是否为空，只要adminName不为空即可绕过第一个检测逻辑，然后在line 1157又检测了Permissions是否等于all，所以当构造cookie中Permissions的值为all即可绕过第二个检测逻辑，然后程序又在line 1162检测了从cookie中取出的adminrand值是否为空，只要adminrand不为空即可绕过第三个检测逻辑，接着在line...

Fedora 17 : moodle-2.2.9-1.fc17 (2013-4404)

Fix for CVEs: CVE-2012-3363 CVE-2013-1830 CVE-2013-1831 CVE-2013-1832 CVE-2013-1833 CVE-2013-1834 CVE-2013-1835 CVE-2013-1836 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

FreeWebshop 2.2.9 Cross Site Scripting / SQL Injection

HTTPCS Advisory : HTTPCS98 Product : FreeWebshop Version : 2.2.9 Date : 2012-09-17 Criticality level : Highly Critical Description : A vulnerability has been discovered in FreeWebshop, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the 'searchfor'...

CVE-2011-5147

Static code injection vulnerability in ajaxsavename.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajaxfilecut.php and then to...

Code injection

Static code injection vulnerability in ajaxsavename.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajaxfilecut.php and then to...

CVE-2011-5147

CVE-2011-5147 affects FreeWebshop 2.2.9 R2 and earlier, specifically the Ajax File Manager module (tinymce plugin). The vulnerability is a static code injection in ajax_save_name.php that lets remote attackers inject arbitrary PHP into data.php via a selected document, shown by a sequence involvi...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in home/secretqtn.php in SocketMail Pro 2.2.9 allows remote attackers to hijack the authentication of arbitrary users for requests that change user security questions and answers via an upd action...

Cross site scripting

Cross-site scripting XSS vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email...

CVE-2012-4058

CVE-2012-4058 affects SocketMail Pro 2.2.9 and is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML via the subject of an email. The referenced sources corroborate the description but do not provide additional exploitation details in the con...

PT-2011-4990 · WordPress · Seo Redirection Plugin

Name of the Vulnerable Software and Affected Versions: Redirection plugin version 2.2.9 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are located in the view/admin/log item.php and view/admin/log item details.php files of the Redirection...

WordPress Redirection Plugin <= 2.2.9 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist. Solution Update the plugin...