GoAhead WebServer 2.1.x Error Page Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5198/info A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible for attackers to launch cross site scripting attacks against vulnerable systems. GoAhead WebServer includes unsanitized...

open-medium.CMS <= 0.25 (404.php) Remote File Include Vulnerability

No description provided by source. DEVIL TEAM THE BEST POLISH TEAM open-medium 0.25 - Content Management System - Remote File Include Vulnerabilities Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl code...

OkCupid: XSS in 404 page of cdn.okccdn.com

The Server does not cleanse the URL data that is sent to it when it gets reported in the 404 page of the error message stating the URL does not exist. it is therefore possible to send javascript in the URL bar and have it execute in the browser. Please see attached screen shots... Server:...

CVE-2013-6786

CVE-2013-6786 is an XSS vulnerability in Allegro RomPager prior to 4.51 used on ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D‑Link DSL-2640R/2641R. The flaw arises when the forbidden author header protection is bypassed, allowing remote attackers to inject arbitrary web sc...

Website url filtering is not strictly caused by downloading any file vulnerability-vulnerability warning-the black bar safety net

At the end of a very busy and recently have been dealing with security issues, of which one example is more representative, and thus wanted to come up with to talk. Probably is such a site in a directory under the provided pdf document to download, but with security, by the path and file name of...

RomPager HTTP Referer Header XSS

The remote RomPager HTTP server is affected by a cross-site scripting vulnerability. The server does not properly sanitize the referer header value when generating a 404 error page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Abuse HTTP Server 2.8 Denial Of Service Vulnerability

Abuse HTTP Server version2 .8 suffers from a remote denial of service vulnerability. Proof of concept python code included. Advisory Information : ====================== Title : Abuse HTTP Server 2.8 - Remote Denial Of Service Advisory ID : Cr02013-002 Product : HTTP Server Vendor : SmartUX...

Share KM 1.0.19 - Remote Denial of Service

Advisory Information : ====================== Title : Share KM 1.0.19 - Remote Denial Of Service Advisory ID : Cr02013-001 Product : Share KM desktop setup file Vendor : SmartUX Vulnerable Versions : 1.0.19 and probably prior release Tested Version : 1.0.19 Tested On : Windows 7 Vulnerability Typ...

disable XSRF check property has no effect on REST API

When disable the xsrf through the property in jira.xsrf.enabled=false in jira-config.properties according to the page|https://developer.atlassian.com/display/JIRADEV/Form+Token+Handling, it doesn't stop the xsrf checking when using JIRA REST API. However, the property took effect when you try som...

NGS00500 Technical Advisory: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version...

WordPress Plugin Better WP Security 3.4.83.4.93.4.103.5.23.5.3 - Persistent Cross-Site Scripting

WordPress Plugin Better WP Security 3.4.83.4.93.4.103.5.23.5.3 - Persistent Cross-Site Scripting ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor...

WordPress Plugin Better WP Security 3.4.8/3.4.9/3.4.10/3.5.2/3.5.3 - Persistent Cross-Site Scripting

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version 3.4.8/3.4.9/3.4.10/3.5.2/3.5.3 Risk...

Bit51 Better WP Security Plugin XSS / Command Execution

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version 3.4.8/3.4.9/3.4.10/3.5.2/3.5.3 Risk...

CVE-2013-2873

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a 404 HTTP status code during the loading of resources...

CVE-2013-2873

Removed by vendor...

CVE-2013-2873

CVE-2013-2873 is a use-after-free vulnerability in Chrome/Chromium related to resource loading. Affected product: Google Chrome before 28.0.1500.71 (and Chromium components referenced in advisories). Impact per sources: potential denial of service and possibly other unspecified effects via exploi...

aCMS 1.0 XSS / Content Spoofing / Information Leak

Hello list! These are Cross-Site Scripting, Content Spoofing and Information Leakage vulnerabilities in aCMS. This is commercial CMS. There are multiple vulnerabilities in aCMS and it's the first part of them. ------------------------- Affected products: ------------------------- Vulnerable are...

Smoke Loader LFI / File Deletion Vulnerabilities

Smoke Loader Command and Control panel suffers from local file inclusion and file deletion vulnerabilities. Two other vulnerabilities I forgot to mention, lfi and file deletion via control.php. The user must be logged into the administrative panel. 1. LFI GET...

Bicololo malware spreading via 404 Error targeting Russians

A Trojan that attacks Russian Internet users using a new trick to spread itself. Known as "Bicololo" was first discovered in October 2012 and specially designed to steal login credentials from users. For this, the malware modify the system Hosts file i.e etc/hosts to host perfect phishing sites v...