Atlassian Crowd XXE Vulnerability (CWD-3366) - Active Check

Atlassian Crowd is prone to an XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Atomymaxsite Shell Upload

Exploit Title: ATOMYMAXSITE CMS Remote Shell Upload Vulnerability + Google Dork: "Powered by ATOMYMAXSITE" + Date: 30/06/2013 + Exploit Author: IranianDarkCodersTeam + Vendor Homepage: http://board.maxsitepro.com + Version: All Version 1.50 - 2.5 + Tested on: Windows 7 + Exploit: +...

Design/Logic Flaw

plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors...

CVE-2013-3267

CVE-2013-3267 is an XSS vulnerability in the Joomla! Highlighter plugin affecting Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4. The issue is triggered by improper validation of user-supplied input, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. Impact det...

CVE-2013-3059

Cross-site scripting XSS vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3267

Cross-site scripting XSS vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Dotclear XSS Vulnerabilities

These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've...

PT-2013-2181 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.5.0 through 2.5.9 Apache CXF versions 2.6.0 through 2.6.6 Apache CXF versions 2.7.0 through 2.7.3 Description: The issue allows remote attackers to bypass authentication when the plaintext UsernameToken WS-SecurityPolicy...

CVE-2012-5972

SpecView’s web server contains a directory traversal vulnerability (CVE-2012-5972) in version 2.5 build 853 and earlier, caused by insufficient input sanitization that lets remote attackers access arbitrary files via a crafted URI. Public PoCs/exploits exist per ICS/ICS-CERT advisories; exploitat...

Discuz!2.5 搜索框漏洞

简要描述： 通过XXS搜索框可以获取 cookies 信息 详细说明： 通过XXS搜索框可以获取 cookies 信息 dz2.5漏洞 所在文件 http://xxxxx.net/misc.php?mod=faq&action=search 在第二个搜索框里可以输进相关代码，非法的人用来搞破坏，那危害就大了 漏洞证明：...

CVE-2012-6498

Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012...

CVE-2012-4532

Cross-site scripting XSS vulnerability in modules/modlanguages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php. NOTE: some of these details are obtained from third party...

Cross site scripting

Cross-site scripting XSS vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4532

CVE-2012-4532 affects Joomla! 2.5.x prior to 2.5.7, where the Language Switcher module (modules/mod_languages/tmpl/default.php) is vulnerable to cross-site scripting via PATH_INFO to index.php. The issue is an XSS in the Language Switcher component, enabling remote injection of script/HTML. The p...

USN-1613-1: Python 2.5 vulnerabilities

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. CVE-2008-5983 It was discovered that the audioop module did not correctly perform...

SA-CONTRIB-2012-155 - ShareThis - Cross Site Scripting (XSS)

This module enables integration with the ShareThis web service to allow social bookmarking amongst your users. The module doesn't sufficiently filter JavaScript settings before outputting them. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

ThinkSNS 2.5 thumb.php 文件上传漏洞

No description provided by source...

Sql injection

SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-1116

CVE-2012-1116 describes an SQL injection vulnerability in Joomla! versions 1.7.x and 2.5.x prior to 2.5.2. Remote attackers can execute arbitrary SQL commands via unspecified vectors. The NVD entry characterizes the impact as partial confidentiality, integrity, and availability loss with network ...

CVE-2012-1611

Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors. NOTE: this might be a duplicate of CVE-2012-1599...