4584 matches found
SQL-injection, XSS in OSSIM (Open Source Security Information Management)
Application: OSSIM http://www.ossim.net Version: 0.9.9rc5 Note: it is possible that the problem affects also earlier OSSIM versions Platforms: Linux Bug: SQL injection, Cross Site Scripting Exploitation: remote Date: 21 Feb 2008 Author: Marcin Kopec E-mail: marcindotkopecathotmaildotcom...
Unfixed XSS vulnerability at devscripts.net
Security researcher RoMeO, has submitted on 21/02/2008 a cross-site-scripting XSS vulnerability affecting devscripts.net, which at the time of submission ranked 1503804 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/04/2008. It is currently...
OSSIM 0.9.9rc5 - Cross-Site Scripting SQL Injection
OSSIM 0.9.9rc5 - Cross-Site Scripting SQL Injection Application: OSSIM http://www.ossim.net Version: 0.9.9rc5 Note: it is possible that the problem affects also earlier OSSIM versions Platforms: Linux Bug: SQL injection, Cross Site Scripting Exploitation: remote Date: 21 Feb 2008 Author: Marcin...
DESlock+ <= 3.2.6 DLMFENC.sys Local Kernel ring0 link list zero PoC
Exploit for unknown platform in category dos / poc =================================================================== DESlock+ DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xDEADBEEF define ZEROMEM 0xDEADBEEF define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq...
Titan FTP Server 6.03 - 'USER/PASS' Remote Heap Overflow (PoC)
Titan FTP SERVER REMOTE HEAP OVERFLOWUSER/PASS Impact : Critical Windbg Output: bec.528: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=41414141 ebx=00000000 ecx=07e415f4 edx=0000000...
GLSA-200801-21 : Xdg-Utils: Arbitrary command execution
The remote host is affected by the vulnerability described in GLSA-200801-21 Xdg-Utils: Arbitrary command execution Miroslav Lichvar discovered that the 'xdg-open' and 'xdg-email' shell scripts do not properly sanitize their input before processing it. Impact : A remote attacker could entice a us...
MoinMoin 1.5.x MOIND_ID cookie Bug Remote Exploit
Exploit for unknown platform in category web applications ================================================= MoinMoin 1.5.x MOINDID cookie Bug Remote Exploit ================================================= !/usr/bin/python Exploit for the MOINDID cookie Bug MoinMoin 1.5.x Find your patch in :...
Mooseguy Blog System 1.0 - month SQL Injection
Mooseguy Blog System 1.0 - month SQL Injection MGBS 1.0 Remote SQL injection Script url http://sourceforge.net/project/showfiles.php?groupid=193233 Vulnerable code in blog.php ?php $month = $GET'month'; $result = mysqlquery"SELECT FROM blog WHERE posted='$month' ORDER BY id DESC" or die"HELP QUER...
Fixed XSS vulnerability at www.egames.com
Security researcher mygotmanoel, has submitted on 21/01/2008 a cross-site-scripting XSS vulnerability affecting www.egames.com, which at the time of submission ranked 100418 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 03/03/2008. It is...
MoinMoin 1.5.x - MOIND_ID Cookie Login Bypass
MoinMoin 1.5.x - MOINDID Cookie Login Bypass !/usr/bin/python Exploit for the MOINDID cookie Bug MoinMoin 1.5.x Find your patch in : http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630 Bug and exploit coded by just a nonroot and colombian user Enero 21 de 2008 Greets: el directorio and all the SL...
Unfixed XSS vulnerability at www.ashcash.net
Security researcher TreX, has submitted on 21/12/2007 a cross-site-scripting XSS vulnerability affecting www.ashcash.net, which at the time of submission ranked 1292978 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 30/12/2007. It is currently...
Shadowed Portal 5.7d3 - Remote Command Execution
Shadowed Portal 5.7d3 - Remote Command Execution !/usr/bin/python -- coding: iso-8859-15 -- ''' / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ------------------------------------------------------------------------------------------------ This is a Public Exploit. 21/12/2007 dd-mm-yyyy...
Unfixed XSS vulnerability at www.cumfiesta.com
Security researcher TreX, has submitted on 21/12/2007 a cross-site-scripting XSS vulnerability affecting www.cumfiesta.com, which at the time of submission ranked 10077 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/01/2008. It is currently...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. MoBiC-21: AIP CAPTCHA bypass...
Fixed XSS vulnerability at justme.ws
Security researcher CCC, has submitted on 21/11/2007 a cross-site-scripting XSS vulnerability affecting justme.ws, which at the time of submission ranked 2852284 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currently fixed...
Unfixed XSS vulnerability at www.ozgurgundem.org
Security researcher BackDoor, has submitted on 18/11/2007 a cross-site-scripting XSS vulnerability affecting www.ozgurgundem.org, which at the time of submission ranked 245274 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/11/2007. It is...
TikiWiki: Multiple vulnerabilities
Background TikiWiki is an open source content management system written in PHP. Description Stefan Esser reported that a previous vulnerability CVE-2007-5423, GLSA 200710-21 was not properly fixed in TikiWiki 1.9.8.1 CVE-2007-5682. The TikiWiki development team also added several checks to avoid...
CVE-2002-2372
The CVE-2002-2372 entry concerns the telnet server in Infoprint 21 controller software prior to version 1.056007. The issue is a possible buffer overflow that allows remote attackers to cause a denial of service (crash) by sending a long username. The connected documents corroborate the same affe...
CVE-2002-2372
The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service crash via a long username, possibly due to a buffer overflow...
GLSA-200710-21 : TikiWiki: Arbitrary command execution
The remote host is affected by the vulnerability described in GLSA-200710-21 TikiWiki: Arbitrary command execution ShAnKaR reported that input passed to the 'f' array parameter in tiki-graphformula.php is not properly verified before being used to execute PHP functions. Impact : An attacker could...