Multiple Vulnerabilities in SantaFox

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SantaFox which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerability in SantaFox: CVE-2010-3463 The vulnerability exists due to input...

Servlet Exec 5.0p06 File Retrieval

Minded Security Labs: Advisory MSA260209 Servlet Exec Multiple Security Issues Tested Versions: Servlet Exec 5.0p06 on Microsoft IIS 6.0 Minded Security ReferenceID: MSA260209 Credits: Discovery by Stefano Di Paola and Giorgio Fedon of Minded Security Stefano Di Paola stefano.dipaola at...

Multiple Vulnerabilities in CMSimple

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in CMSimple which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in CMSimple The vulnerability exists due to input sanitation...

Cross-site Scripting (XSS) Vulnerabilities in eazyCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in eazyCMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in eazyCMS 1.1 The vulnerability exists due to input sanitation error in the "pageid" parameter...

Multiple Cross-site Scripting (XSS) Vulnerabilities in allinta CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in allinta CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in allinta CMS 1.1 The vulnerability exists due to input sanitation error in the "langURL"...

Multiple Vulnerabilities in Amethyst

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Amethyst which could be exploited to perform cross-site scripting, script insertion and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerability in Amethyst The vulnerability exists due to inp...

Novell Teaming Default Credentials

The installed version of Novell Teaming hosted on the remote web server uses the default username and password to control access to its administrative console. Knowing these, an attacker can gain control of the affected application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Cross-site Scripting (XSS) Vulnerabilities in Campsite

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in Campsite which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Campsite 1.1 The vulnerability exists due to input sanitation error in the "fcommentsearch"...

Multiple Cross-site Scripting (XSS) Vulnerabilities in Spitfire

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Spitfire which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Spitfire 1.1 The vulnerability exists due to input sanitation error in the "cmsid" and...

Cross-site Scripting (XSS) Vulnerability in Gekko Web Builderer

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Gekko Web Builder which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Gekko Web Builder The vulnerability exists due to input sanitation error in the "app" parameter...

Cross-site Scripting (XSS) Vulnerability in DSite CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DSite CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in DSite CMS The vulnerability exists due to input sanitation error in the "buttonname" parameter in...

Cross-site Scripting (XSS) Vulnerabilities in Diem

High-Tech Bridge SA Security Research Lab has discovered three vulnerabilities in Diem which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in Diem 1.1 The vulnerability exists due to input sanitation error in the "value" parameter in page...

Apache Axis 1.5 Session Fixation

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira ' 'Leandro Oliveira ' ======== Table of Contents =========================================== 1. Overview 2. Detailed description 3. Other...

PHPWCMS Cross-Site Request Forgery Vulnerability

No description provided by source. ?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah...

Apache Axis Session Fixation Vulnerability

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira tiago SPAM tempest.com.br' 'Leandro Oliveira leandro SPAM tempest.com.br' ======== Table of Contents...

PHPWCMS 1.4.5 r398 Cross Site Request Forgery

PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc var frm = document.getElementById"csrf"; frm.submit; window.onload = myfunc; input type="hidden"...

CSRF in PHPWCMS 1.4.5

?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah Talamantes RedTeam Security RedTeam Labs...

PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery

PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc var frm = document.getElementById"csrf"; frm.submit; window.onload = myfunc; input type="hidden" name="dirpublic" val...

PHPWCMS 1.4.5 r389 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications =========================================================== PHPWCMS 1.4.5 r389 Cross Site Request Forgery Vulnerability =========================================================== PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc v...

Cross-site Request Forgery (CSRF) in Kryn.cms

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Kryn.cms which could be exploited to perform cross-site request forgery attacks. 1 Cross-site Request Forgery CSRF in Kryn.cms The vulnerability exists due to insufficient validation of the request origin in...