Quick CMS 6.1 Cross Site Request Forgery / Cross Site Scripting

-------------------------- - Exploit Title : Quick CMS CSRF/XSS - Vendor Homepage: http://opensolution.org - Software Link: - http://opensolution.org/download/home.html?sFile=Quick.Cmsv6.1-en.zip - Version : 6.1 - Date: 2016-21-01 - Tested On : Windows 7 / FireFox -------------------------- -...

http-vuln-cve2013-6786 NSE Script

Detects a URL redirection and reflected XSS vulnerability in Allegro RomPager Web server. The vulnerability has been assigned CVE-2013-6786. The check is general enough script tag injection via Referer header that some other software may be vulnerable in the same way. See also:...

Algolia: text injection can be used in phishing 404 page should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://www.algolia.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one...

HackerOne: HackerOne Private Programs users disclosure and de-anonymous-ize

Hi HackerOne Team, I have found a bug in HackerOne Platform allows any attacker to deanonymousize any security researcher using the platform and the most wild usage is to disclose some information about this security researcher if he is invited to a private program or not. Unfortunately HackerOne...

Oracle: Security Advisory (ELSA-2015-0783)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2014-404)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dedecms远程写文件漏洞

来源链接：http://seclists.org/fulldisclosure/2015/Jun/47 http://blog.nsfocus.net/dedecms-write-file-vuln/ 0x00 漏洞概述2015年6月17日seclists网站上公布了Dedecms的一个远程getshell漏洞细节，造成这个漏洞的原因也有些让人玩味。官方已在2015年6月18日发布了修复版本，下载链接：http://www.dedecms.com/products/dedecms/downloads/本篇文章将分析这个漏洞的成因，并给出触发利用方法。0x01...

CVE-2014-3148

Cross-site scripting XSS vulnerability in libahttp/err.c in OkCupid OKWS OK Web Server allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to a non-existent page, which is not properly handled in a 404 error page...

CVE-2014-3148

Cross-site scripting XSS vulnerability in libahttp/err.c in OkCupid OKWS OK Web Server allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to a non-existent page, which is not properly handled in a 404 error page...

CVE-2015-3267

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-3267

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

HTTP Client Automatic Exploiter 2 (Browser Autopwn)

This module will automatically serve browser exploits. Here are the options you can configure: The INCLUDEPATTERN option allows you to specify the kind of exploits to be loaded. For example, if you wish to load just Adobe Flash exploits, then you can set Include to 'adobeflash'. The EXCLUDEPATTER...

BIG-IQ 0.0.7028 Information Disclosure

Hi, I'm testing BIG-IQ v 0.0.7028, no the last HF but i don't see the bug fix in the HF1 the new mngmt of F5 BIG-IP, i see that you are loggout and join to the next link LINK : where $user is the user https://127.0.0.1/mgmt/shared/authz/users/$user/ When i open this link and try some diff users...

GoAccess - Real-time Web Log Analyzer and Interactive Viewer

GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal in nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features GoAccess parses the specified web log file and...

WordPress Plugin All In One WP Security & Firewall admin/wp-security-list-404.php SQL Injection Vulnerability

WordPress is a set of blogging platform developed in PHP language by WordPress Software Foundation, which supports setting up personal blog sites on servers with PHP and MySQL.All In One WP Security & Firewall Plugin for WordPress is a Wordpress Security Plugin. All In One WP Security & Firewall...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0895

All In One WP Security & Firewall for WordPress (versions before 3.9.0) is affected by a CSRF vulnerability that can allow an attacker, while a logged-in admin exists, to hijack the administrator’s authentication to delete 404 logs via forged requests. Root cause is CSRF in the plugin; impact inc...

VSAT Sailor 900 - Remote Overflow

VSAT Sailor 900 - Remote Overflow / File : satcompwn.c - VSAT SAILOR SAT COM 900 Remote 0day Author : Nicholas Lemonias This is proprietary source code material of Advanced Information Security Corporation. Usage, distribution and modifications are pursuant to our terms of agreement. Copyright c...

shopNC O2O系统任意文件删除漏洞

简要描述： 齐博齐博快确认，确认了我再送个0day shopNC的任意文件删除挺多的，我拿O2O系统来说明问题吧。 详细说明： /circle/control/cut.php 46行 / 图片裁剪 / public function piccutOp import'function.thumb'; if chksubmit $thumbwidth = $POST'x'; $x1 = $POST"x1"; $y1 = $POST"y1"; $x2 = $POST"x2"; $y2 = $POST"y2"; $w = $POST"w"; $h = $POST"h"; $scale =...