CVE-2012-2209

CVE-2012-2209 affects Piwigo prior to 2.3.4, exposing multiple XSS vulnerabilities in admin.php via the section, installstatus, and theme parameters. The issue enables remote attackers to inject arbitrary HTML/script in an administrator session. Vendor patch: upgrade to Piwigo 2.3.4 (remediation)...

CVE-2012-2208

CVE-2012-2208 : Affected software is Piwigo up to version 2.3.3 (pre-2.3.4). Root cause is a directory traversal via the language parameter in upgrade.php, allowing remote attackers to include and execute arbitrary local PHP files. Impact: potential code execution through include() of crafted fil...

CVE-2012-2949

The ZTE syncagent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523 password to control access to commands, which allows remote attackers to gain privileges via a crafted application...

CVE-2012-2949

The ZTE syncagent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523 password to control access to commands, which allows remote attackers to gain privileges via a crafted application...

CVE-2012-2949

CVE-2012-2949 : The ZTE sync_agent on Android 2.3.4 (Score M) uses a hardcoded password (ztex1609523) to control access to commands, enabling remote privilege escalation via a crafted application. The description and related sources confirm the component and the root cause (hardcoded credential i...

gkrellm-info NSE Script

Queries a GKRellM service for monitoring information. A single round of collection is made, showing a snapshot of information at the time of the request. Example Usage nmap -p 19150 --script gkrellm-info Script Output PORT STATE SERVICE 19150/tcp open gkrellm | gkrellm-info: | Hostname: ubu1110 |...

Multiple vulnerabilities in Piwigo

Advisory ID: HTB23085 Product: Piwigo Vendor: Piwigo project Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Vendor Notification: 4 April 2012 Vendor Patch: 8 April 2012 Public Disclosure: 25 April 2012 Vulnerability Type: Directory Path Traversal, Cross-Site Scripting XSS CVE...

piwigo 2.3.3 - Multiple Vulnerabilities

Advisory ID: HTB23085 Product: Piwigo Vendor: Piwigo project Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Vendor Notification: 4 April 2012 Vendor Patch: 8 April 2012 Public Disclosure: 25 April 2012 Vulnerability Type: Directory Path Traversal, Cross-Site Scripting XSS CVE...

Postfixadmin 2.3.4 SQL Injection / Cross Site Scripting

Advisory ID: CSA-12002 Title: Multiple vulnerabilities in postfixadmin Product: postfixadmin Version: 2.3.4 and probably prior Vendor: www.postifixadmin.org Vulnerability type: SQL injection, XSS Vendor notification: 2012-01-10 Public disclosure: 2012-01-26 postfixadmin version 2.3.4 and probably...

In-link 2.3.4/5.1.3 RC1 - 'cat' SQL Injection

source: https://www.securityfocus.com/bid/49508/info In-link is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data,...

CVE-2011-2357

Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by 1 causing the MAXTAB number of tabs to be opened, then loading a URI to the targeted...

Cross site scripting

Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by 1 causing the MAXTAB number of tabs to be opened, then loading a URI to the targeted...

Open Handset Alliance Android 2.3.43.1 - Browser Sandbox Security Bypass

Open Handset Alliance Android 2.3.43.1 - Browser Sandbox Security Bypass source: https://www.securityfocus.com/bid/48954/info Open Handset Alliance Android is prone to a vulnerability that may allow a bypass of the browser sandbox. Successful exploits will allow attackers to execute arbitrary...

ftp-vsftpd-backdoor NSE Script

Tests for the presence of the vsFTPd 2.3.4 backdoor reported on 2011-07-04 CVE-2011-2523. This script attempts to exploit the backdoor using the innocuous id command by default, but that can be changed with the exploit.cmd or ftp-vsftpd-backdoor.cmd script arguments. References: Script Arguments...

Video Demonstration : Vsftpd backdoor discovered by Mathias Kresin

Video Demonstration : Vsftpd backdoor discovered byMathias Kresin 2.3.4 of vsftpd's downloadable source code was compromised and a backdoor added to the code. Evans, the author of vsftpd . This module exploits a malicious backdoor that was added to the VSFTPD download archive. This backdoor was...

VSFTPD v2.3.4 Backdoor Command Execution

Exploit for unix platform in category remote exploits $Id: vsftpd234backdoor.rb 13099 2011-07-05 05:20:47Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on...

Vulnerability in Google ClientLogin Protocol !

Vulnerability in Google ClientLogin Protocol ! A group of security and privacy researchers from the Institute of Media Informatics at Ulm University in Germany, is claiming to have discovered a serious security vulnerability in Google's ClientLogin protocol. In a recent analysis of the Android...

python security update

2.3.4-14.10 - add patch adapted from upstream patch 208 to add support for building against system expat; add --with-system-expat to configure invocation; remove embedded copy of expat 1.95.7 from the source tree during prep - ensure pyexpat.so gets built by explicitly listing all C modules in th...

Front Accounting 2.3.4 CSRF Vulnerability

Exploit for php platform in category web applications Software................Front Accounting 2.3.4 Vulnerability...........Cross-site Request Forgery Threat Level............Low 1/5 Download................http://frontaccounting.com/wb3/ Discovery Date..........4/27/2011 Tested...

Front Accounting 2.3.4 - Cross-Site Request Forgery

Front Accounting 2.3.4 - Cross-Site Request Forgery Software................Front Accounting 2.3.4 Vulnerability...........Cross-site Request Forgery Threat Level............Low 1/5 Download................http://frontaccounting.com/wb3/ Discovery Date..........4/27/2011 Tested...