PT-2012-3579

Name of the Vulnerable Software and Affected Versions All-in-One Event Calendar plugin versions 1.4 and 1.5 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various parameter...

CVE-2012-1835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to app/view/agenda-widget-form.php; 2 args, 3 title, 4 beforetitle, or 5 aftertitle parameter...

PT-2012-4737

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through vectors related to 1 the verify function in application/controllers/alerts.php, 2 the save al...

UBUNTU-CVE-2012-3392

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums...

UBUNTU-CVE-2012-2354

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL...

UBUNTU-CVE-2012-2364

Cross-site scripting XSS vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a...

PT-2012-3975 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.1.x through 2.1.5 Moodle versions 2.2.x through 2.2.2 Description: The issue allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages. This is achieved by...

WordPress Chenpress Shell Upload

Exploit Title : Wordpress chenpress Plugin Arbitrary File Upload Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://wordpress.org Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork :...

web@all - name Cross-Site Scripting

web@all - name Cross-Site Scripting source: https://www.securityfocus.com/bid/54466/info web@all is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

web@all - 'name' Cross-Site Scripting

source: https://www.securityfocus.com/bid/54466/info web@all is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Ajax Data Uploader Shell Upload

0101010101----010101010101010 01 01------0101 0101 01 01------0101 0101 01 01------0101 0101 01 01------0101 0101 01 01------0101 0101 01 01------0101 0101 01 01------0101010101 01 01------0101 010 01 01------0101 010 01 01------0101 010 01 01------0101 010 01 01------0101 010 0101010101----0101...

Wordpress (editormonkey) Arbitrary File Upload Vulnerability

a bug in Wordpress editormonkeythat allows to us to occur a File Upload on a Remote machin. Exploit Title : Wordpress editormonkey Arbitrary File Upload Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://wordpress.org Security Risk : High...

Code injection

Unspecified vulnerability on HP Photosmart Wireless e-All-in-One B110, e-All-in-One D110, Plus e-All-in-One B210, eStation All-in-One C510, Ink Advantage e-All-in-One K510, and Premium Fax e-All-in-One C410 printers allows remote attackers to cause a denial of service via unknown vectors...

ZipBox - Sql injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 x...

CVE-2012-2017: Undefined Security Weakness

Unspecified vulnerability on HP Photosmart Wireless e-All-in-One B110, e-All-in-One D110, Plus e-All-in-One B210, eStation All-in-One C510, Ink Advantage e-All-in-One K510, and Premium Fax e-All-in-One C410 printers allows remote attackers to cause a denial of service via unknown vectors...

PT-2012-3732

Name of the Vulnerable Software and Affected Versions HP Photosmart Wireless e-All-in-One B110 HP Photosmart e-All-in-One D110 HP Photosmart Plus e-All-in-One B210 HP Photosmart eStation All-in-One C510 HP Photosmart Ink Advantage e-All-in-One K510 HP Photosmart Premium Fax e-All-in-One C410...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in web@all 2.0, as downloaded before May 30, 2012, allows remote attackers to inject arbitrary web script or HTML via the texttitle parameter...

CVE-2012-3232

The CVE-2012-3232 entry relates to web@all 2.0. Affected component: search.php; vulnerability types: CSRF (CVE-2012-3231) and XSS (CVE-2012-3232). Root cause: input passed via the GET parameter _text[title] is not properly sanitized, allowing an attacker to inject arbitrary HTML/script in the use...

CVE-2012-3232: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in web@all 2.0, as downloaded before May 30, 2012, allows remote attackers to inject arbitrary web script or HTML via the texttitle parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in web@all 2.0, as downloaded before May 30, 2012, allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding a file to execute arbitrary...