Maroyaka CGI Maroyaka Image Album Cross-Site Scripting Vulnerability

Maroyaka CGI Maroyaka Image Album is a CGI script for placing image files into websites. A cross-site scripting vulnerability exists in Maroyaka CGI Maroyaka Image Album. A remote attacker could use this vulnerability to inject arbitrary web script or HTML...

Maroyaka Image Album vulnerable to cross-site scripting

Overview Maroyaka Image Album provided by Maroyaka CGI is a CGI script for placing image files within a website. Maroyaka Image Album contains a cross-site scripting vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#09871547: Maroyaka Image Album vulnerable to cross-site scripting

Maroyaka Image Album provided by Maroyaka CGI is a CGI script for placing image files within a website. Maroyaka Image Album contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest versi...

Value 1 2 5 0 0 dollars to the Facebook album delete vulnerability-vulnerability warning-the black bar safety net

Overview: if your photo is deleted unknowingly, what will you do? Obviously, this problem is very annoying huh? This post is to say I found a vulnerability which allows a malicious user to delete Facebook on any album. Yes, any user, page, group, photo album can be deleted. The Graph API is the...

Facebook Vulnerability Allows Hacker to Delete Any Photo Album

A Serious vulnerability in Facebook has recently been reported that could allow anyone to delete your complete Facebook photo album without having authentication. Security Researcher Laxman Muthiyah told The Hacker News that the vulnerability actually resides in Facebook Graph API mechanism, whic...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Facebook Album Fetcher

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple cross-site scripting vulnerabilities exist in Drupal Facebook Album Fetcher due to the program failing to properly filter user-supplied input. An attacker could u...

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

Facebook Album Fetcher module allows you to fetch Facebook albums from a Facebook account. The module incorrectly prints fields without proper sanitization thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

VeryPhoto v3.0 iOS - Command Injection Vulnerability

Document Title: =============== VeryPhoto v3.0 iOS - Command Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ==================================== 1401...

VeryPhoto 3.0 Command Injection Vulnerability

VeryPhoto version 3.0 suffers from a command injection vulnerability. Document Title: =============== VeryPhoto v3.0 iOS - Command Injection Vulnerability Product & Service Introduction: =============================== VeryPhoto Pro is your side of the most powerful local album management softwar...

VeryPhoto 3.0 Command Injection

Document Title: =============== VeryPhoto v3.0 iOS - Command Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ==================================== 1401...

VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability

Document Title: =============== VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ====================================...

VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability

Document Title: =============== VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ====================================...

Free open source photo album Piwigo<= v2. 7. 1 SQL injection vulnerability analysis-vulnerability warning-the black bar safety net

Some time ago a free open source photo album Piwigopwigo apiwigo = 2.6.0 sql injection vulnerabilitythe. Vulnerability published, piwigo has been updated to 2. 7. To 1. However, this vulnerability published time is indeed a genuine 0day, the impact of piwigo full version. The following was on the...

Discuz! x某功能越权漏洞#1

简要描述： RT 详细说明： 问题出现在个人相册处： 首先我本地搭建个最新版的dz 1.先用test账号上传个图片进行权限设置 - 自己可见 2.用test111账号查看test账号的相册内容 显示加密 http://localhost/dz3.2wwwroot/home.php?mod=space&uid=2&do=album&id=1 album&id=1 显示的是加密相册的id 记录下来 3.随便去发帖 - 选择图片 - 审查元素 - 将111111 https://images.seebug.org/upl...

Discuz! x某功能越权漏洞#2

简要描述： RT 详细说明： 继上一个越权再来一个 求不忽略 - - 1.用test111号码新建一个相册上传个图片做测试 如： 我们可以获取相册ID为2 http://localhost/dz3.2wwwroot/home.php?mod=space&uid=3&do=album&id=2 album&id=2 相册ID 2.用test号 去上传图片 然后将 【选择相册】参数改成test111号的 保存后 成功 发现相册被改 漏洞证明： 继上一个越权再来一个 求不忽略 - - 1.用test111号码新建一个相册上传个图片做测试 如： 我们可以获取相册ID为2...

Discuz! x某功能越权漏洞

简要描述： rt 详细说明： 相册功能,里面的编辑图片说明可以越权修改 在 source/include/spacecp/spacecpalbum.php中 code foreach $POST'title' as $picid = $value //这里遍历数据 if$value == $GET'oldtitle'$picid continue; $title = getstr$value, 150; $title = censor$title; ifcensormod$title || $G'group''allowuploadmod' $picstatus = 1;...

WP Photo Album Plus 5.4.4 & 5.4.3 Cross-Site Scripting (XSS)

The WP Photo Album Plus WordPress plugin was affected by security vulnerability...

[SECURITY] Fedora 20 Update: kphotoalbum-4.5-2.fc20

A photo album tool. Focuses on three key points: It must be easy to describe a number of images at a time. It must be easy to search for images. It must be easy to browse and View the images...

WordPress Photo Album Plus 5.4.4 Cross Site Scripting

WP Photo Album Plus Security Vulnerabilities Author: Milhouse Download: https://wordpress.org/plugins/wp-photo-album-plus/ Home Page: http://wppa.opajaap.nl/ Google dork: inurl:wp-content/plugins/wp-photo-album-plus Set up: Wordpress Version: 3.9.1, 3.9.2 WP Photo Album Plus version: 5.4.4, 5.4.3...

Design/Logic Flaw

The Eversnap Private Photo Album aka com.weddingsnap.android application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...