Joomla com_propiedades Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Joomla comcompropiedades Multiple Vulnerabilities Date: 23.06.2011 Author: z0mbyak Vendor or Software Link: find by yourself Version: Don't know Category: remote, webapps. Google dork: inurl:"index.php?option=com propiedades"...

EQDKP plus Cross Site Scripting and Bypass file extension

Hello! I have found a vulnerability in the EQDKP Plus. More precisely in the plugin mediacenter. Because of incorrectly checks the file extension it is possible to upload the "htm" file and execute XSS attack. But with some restrictions. The plugin checks the contents for tags:...

WSO Web Shell 2.5.1 Download

This utility provides a Web interface for remote operation c operating system and its service / daemon. Opportunity Description / features: Authorization for cookies Server Information File manager copy, rename, move, delete, chmod, touch, creating files and folders View, hexview, editing,...

WSO Web Shell 2.5.1 Download

This utility provides a Web interface for remote operation c operating system and its service / daemon. Opportunity Description / features: Authorization for cookies Server Information File manager copy, rename, move, delete, chmod, touch, creating files and folders View, hexview, editing,...

Debian DSA-2246-1 : mahara - several vulnerabilities

Several vulnerabilities were discovered in Mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-1402 It was discovered that previous versions of Mahara did not check user credentials before...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Post Revolution 0.8.0c-2 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests to 1 ajax-weblog-guardar.php, 2 verpost.php, 3 comments.php, or 4 perfil.php...

CVE-2011-1954

Multiple cross-site request forgery CSRF vulnerabilities in Post Revolution 0.8.0c-2 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests to 1 ajax-weblog-guardar.php, 2 verpost.php, 3 comments.php, or 4 perfil.php...

CVE-2011-1954

Post Revolution 0.8.0c and earlier is affected by CSRF in multiple endpoints (ajax-weblog-guardar.php, verpost.php, comments.php, perfil.php), enabling remote attackers to hijack user sessions. The vulnerability is described consistently across CVE-2011-1954 entries; the root cause is inadequate ...

Ajax Chat 1 Cross Site Scripting

Vulnerability ID: HTB22995 Reference: http://www.htbridge.ch/advisory/xssinajaxchat.html Product: Ajax Chat Vendor: php-development.ru Vulnerable Version: 1 Vendor Notification: 10 May 2011 Vulnerability Type: XSS Cross Site Scripting Risk level: Medium Credit: High-Tech Bridge SA Security Resear...

HTB22995: XSS in Ajax Chat

Vulnerability ID: HTB22995 Reference: http://www.htbridge.ch/advisory/xssinajaxchat.html Product: Ajax Chat Vendor: php-development.ru Vulnerable Version: 1 Vendor Notification: 10 May 2011 Vulnerability Type: XSS Cross Site Scripting Risk level: Medium Credit: High-Tech Bridge SA Security Resear...

Ajax Chat 1.0 - ajax-chat.php Cross-Site Scripting

Ajax Chat 1.0 - ajax-chat.php Cross-Site Scripting source: https://www.securityfocus.com/bid/47953/info Ajax Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in...

Ajax Chat 1.0 - 'ajax-chat.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/47953/info Ajax Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context ...

CVE-2011-1404

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with 1 blocktype/myfriends/myfriends.json.php, 2 json/usersearch.php, 3 group/membersearchresults.json.php, or 4...

CVE-2011-1404

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with 1 blocktype/myfriends/myfriends.json.php, 2 json/usersearch.php, 3 group/membersearchresults.json.php, or 4...

CVE-2011-1404

Mahara prior to version 1.3.6 is affected by CVE-2011-1404, where JSON responses exposed more information than necessary in AJAX endpoints (blocktype/myfriends/myfriends.json.php, json/usersearch.php, group/membersearchresults.json.php, json/friendsearch.php). The issue is an information disclosu...

CVE-2011-1404

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with 1 blocktype/myfriends/myfriends.json.php, 2 json/usersearch.php, 3 group/membersearchresults.json.php, or 4...

Cross-site Scripting (XSS) Vulnerability in Ajax Chat

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Ajax Chat which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Ajax Chat The vulnerability exists due to input sanitation error in the "chatpath" parameter in...

A period of WIN7 under GMAIL MHTML vulnerability test code-vulnerability warning-the black bar safety net

RAyh4c black box Long time no update blog, and turn to a section 7 under the GMAIL MHTML vulnerability test code, finally written the full version of the Don't know to throw which went to the - -! The MHTML vulnerability in WINDOWS 7 to initiate the AJAX request, does not like XP, direct request...

HTB22973: XSS in AJAX Calendar

Vulnerability ID: HTB22973 Reference: http://www.htbridge.ch/advisory/xssinajaxcalendar.html Product: AJAX Calendar Vendor: OpenCrypt http://www.opencrypt.com Vulnerable Version: 1.0 Vendor Notification: 21 April 2011 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by Vendor Risk level...

WordPress Plugin WP Ajax Calendar 1.0 - example.php Cross-Site Scripting

WordPress Plugin WP Ajax Calendar 1.0 - example.php Cross-Site Scripting source: https://www.securityfocus.com/bid/47726/info WP Ajax Calendar is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...