CVE-2016-9419

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Grid Gallery 1.0 - Admin Panel Authentication Bypass

======================================================================================================= Grid Gallery 1.0 Admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built upon Grid Gallery as they can gain access to the admin...

Getting Started with Citrix Secure Web

The purpose of this getting started guide is to provide a reference document with key information about Citrix Citrix Secure Web. Navigation: What is Citrix Secure Web? Citrix Secure Web MicroVPN Connection Modes Supported Web Technologies Configure Citrix Secure Web and Proxy Servers MicroVPN...

OpenDocMan 1.3.4 - Cross-Site Request Forgery

OpenDocMan 1.3.4 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: Opendocman 1.3.4 Fixed in: 1.3.5 Fixed Version Link: http://www.opendocman.com/free-download/ Vendor Website: http://www.opendocman.com/ Vulnerability Type: CSRF Remote...

Advanced Electron Forum 1.0.9 - Remote File Inclusion Cross-Site Request Forgery

Advanced Electron Forum 1.0.9 - Remote File Inclusion Cross-Site Request Forgery + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-RFI.txt Vendor: ============================= www.anelectron.com/downloads/ Product:...

Advanced Electron Forum 1.0.9 - Remote File Inclusion / Cross-Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-RFI.txt Vendor: ============================= www.anelectron.com/downloads/ Product: ================================ Advanced Electron Forum v1.0.9 AEF Exploit patched current version...

Wave by wave cms file upload vulnerability

Wave CMS is the use of dotNET2.0 technology platform architecture, based on MSSQL2005 compatible with MSSQL2000 technology development of the site management system. Wave CMS file upload vulnerability, /Plugins/swfFileUpload/UploadHandler.ashx global filtering, can be bypassed by rewriting the ca...

phpSQLiteCMS CSRF, Unrestricted File Type Upload, Privilege Escalation & XSS CSRF, Unrestricted File Type Upload, Privilege Escalation & XSS

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPSQLITECMS0712.txt Vendor: ================================ phpsqlitecms.net Product: ================================ ilosuna-phpsqlitecms-d9b8219 Advisory Information:...

WordPress GD bbPress Attachments 2.1 Cross Site Scripting / Local File Inclusion Vulnerabilities

WordPress GD bbPress Attachments plugin version 2.1 suffers from a cross site scripting and Local File Inclusion Vulnerabilities Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report:...

Xen unspecified domctl operation denial of service vulnerability

Xen is a virtualization technology for the Linux kernel that allows multiple operating systems to run simultaneously. A security vulnerability exists in Xen when using toolstack decomposition. A denial-of-service attack is allowed on a remote domain under partial administrative control via an...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-2334

Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

MyBB 1.8.1 /admin/modules/config/language.php 跨站脚本漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register This poc requires a valid credentialcookie to the ACPAdmin Control Panel to work. class TestPOCPOCBase: vulID =...

Google's Devices and Activity Dashboard — A New Account Security Wizard

We access our Google account from so many devices that we our self forget on how many devices our account is still connected and perhaps we don't use that device anymore. To make this problem easy for you, Google has come up with its new security dashboard which will help you keep better control...

TP-Link TL-WR740N - Denial of Service

TP-Link TL-WR740N Wireless Router MitM httpd Denial Of Service Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.17.0 Build 140520 Rel.75075n Released: 5/20/2014 - Firmware version: 3.16.6 Build 130529 Rel.47286n Released:...

PageAdmin几个设计缺陷导致的安全漏洞

简要描述： 1.loginkey暴力预测 2.伪造任意会员或管理留言 3.删除任意留言 ps：.net开源了，相信各种特性漏洞会如雨后春笋般涌现，小菜先学点asp.net基础知识，等大牛们发特性漏洞的时候至少能够看懂。 详细说明： 1.loginkey 暴力预测 /e/member/checkrepeat.aspx protected void PageLoadObject src,EventArgs e CheckPost; string Field=Request.Form"field";//数据传入 自定义字段 string...

Wordpress Login Widget With Shortcode 3.1.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: Login Widget With Shortcode Version: 3.1.1 Homepage: http://wordpress.org/plugins/login-sidebar-widget/ Advisory report:...

Real Estate SQL Injection Vulnerability

No description provided by source. Description Linux And window Version available: This software is available in both windows and linux version. It runs on asp and php extension. Listings: We can add unlimited property listing, with the property photo. System automatically creates three thumbnail...

JiRo's Upload System 1.0 Login.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13833/info JiRo's Upload System is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitati...

WordPress Plugin My Category Order <= 2.8 - SQL Injection Vulnerability

No description provided by source. Source: WordPress Plugin: My Category Order = 2.8 mycategoryorder.php / SQL Injection Vulnerability Download: http://wordpress.org/extend/plugins/my-category-order/ No Dork Author: ManhLuat93 at hcegroupdotnet Errors appears only when you have admin control Open...