Cisco Identity Services Engine Software Administration Panel Cross-Site Scripting Vulnerability

A vulnerability in the search form of the Cisco ISE administration/monitoring panel could allow an unauthenticated, remote attacker to send a malicious script to an unsuspecting user. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by convincing...

http-coldfusion-subzero NSE Script

Attempts to retrieve version, absolute path of administration panel and the file 'password.properties' from vulnerable installations of ColdFusion 9 and 10. This was based on the exploit 'ColdSub-Zero.pyFusion v2'. See also: http-adobe-coldfusion-apsa1301.nse http-vuln-cve2009-3960.nse...

phpVms Virtual Airline Administration 2.1.9342.1.935 - SQL Injection

phpVms Virtual Airline Administration 2.1.9342.1.935 - SQL Injection ============================================================================================================= o phpVMS Virtual Airline Administration = SQL Injection Vulnerability Software : phpVMS Virtual Airline Administration...

phpVms Virtual Airline Administration 2.1.934/2.1.935 - SQL Injection

============================================================================================================= o phpVMS Virtual Airline Administration = SQL Injection Vulnerability Software : phpVMS Virtual Airline Administration Version : 2.1.934 & 2.1.935 Vendor : http://www.phpvms.net Author :...

Citadel Trojan Updates with Dynamic Config Mechanism that Streamlines Fraud Activity

The elusive authors of the Citadel Trojan have released a new version of their banking botnet malware and service. The latest version, the sixth since it debuted in January and dubbed Rain, includes a dynamic configuration mechanism that allows botmasters to inject malicious content to compromise...

Sciretech 3.0.0 SQL Injection / CSRF Vulnerability

Exploit for php platform in category web applications ========================================================= Vulnerable Software: Sciretech ® Multimedia Manager Version 3.0.0 Aka: Sciretech ® File Manager Version 3.0.0 Official site: www.sciretech.com Vulnerabilities: Blind SQL Injection And...

Sciretech 3.0.0 SQL Injection / CSRF

========================================================= Vulnerable Software: Sciretech ® Multimedia Manager Version 3.0.0 Aka: Sciretech ® File Manager Version 3.0.0 Official site: www.sciretech.com Vulnerabilities: Blind SQL Injection And CSRF Dork: Google is Best Your Friend.Isn't? Discovered...

Cotonti 0.6.23 SQL Injection

================================================================== Vulnerable Software: cotonti-0.6.23 Official Site: http://www.cotonti.com/ Tested version: http://cotonti.googlecode.com/files/cotonti-0.6.23.7z ================================================================== About Software:...

PHPNet 1.8 SQL Injection

SQL Injection This exploit is for a vulnerability in ler.php, but are the same vulnerability on imprimir.php and imagem.php. ler.php?id=SQLi imprimir.php?id=SQLi imagem.php?id=SQLi Usage: php file.php http://server/path/ Login bypass In login page, you can bypass the login using "SQLi strings". G...

Supernews <= 2.6.1 SQL Injection Exploit

Exploit for php platform in category web applications ?php Exploit Title: Supernews = 2.6.1 SQL Injection Exploit Google Dork: intext:"2003 - 2004 : SuperNews : Todos os direitos reservados" Date: 2012/ Author: WhiteCollarGroup Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews...

CVE-2011-4731

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files...

CVE-2011-4730

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in...

CVE-2011-4728

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies us...

CVE-2011-4729

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by...

CVE-2011-4727

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error or possibly have unspecified other impact via a crafte...

CVE-2011-4725

Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by loginup.php3 and certain other files...

Sql injection

Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by loginup.php3 and certain other files...

Code injection

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error or possibly have unspecified other impact via a crafte...

Design/Logic Flaw

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

Design/Logic Flaw

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout...