[ParameterFuzz v1.8] Parameter´s auditor for web applications

ParameterFuzz is a tool to check the level of fortification in web applications, try to cover the field more exploited by hackers, as the majority of known attacks are based on exploiting poorly filtered parameters. Just as SQL injection, Cross Site Scripting or RFI among others. This tool is...

i-doit Pro - 'objID' SQL Injection

source: https://www.securityfocus.com/bid/65557/info i-doit Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

Secret: Strict Transport Security on secret.ly

Bug: Strict Transport Security. Description: The application was not sending the Strict-Transport-Security header. This header is used to force browsers to connect to the application trough a SSL connection. Impact: If the connections to the web application are not encrypted, an eavesdropper may ...

CVE-2013-6166

CVE-2013-6166 affects Google Chrome pre-29. The issue arises when Chrome sends HTTP Cookie headers without validating that cookies meet character-set restrictions, enabling a remote attacker to trigger a persistent Logout CSRF-like effect by crafting a parameter that causes a web app to set a mal...

Multiple Vulnerabilities in OpenDocMan

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenDocMan, which can be exploited to perform SQL Injection and gain administrative access to the application. 1 SQL Injection in OpenDocMan: CVE-2014-1945 The vulnerability exists due to insufficient validation of...

jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities

Document Title: =============== jDisk stickto v2.0.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1196 Release Date: ============= 2014-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 11...

Tableau Server 8.0.7 8.1.2 - Blind SQL Injection

Tableau Server 8.0.7 8.1.2 - Blind SQL Injection Trustwave's SpiderLabs Security Advisory TWSL2014-003: Blind SQL Injection Vulnerability in Tableau Server Published: 02/07/14 Version: 1.1 Vendor: Tableau Software http://www.tableausoftware.com Product: Tableau Server Versions affected: 8.1.X...

[Netsparker v3.2] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

ZenPhoto - SQL Injection

source: https://www.securityfocus.com/bid/65126/info ZenPhoto is prone to an SQL-injection vulnerability and multiple path-disclosure vulnerabilities. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlyi...

ManageEngine EventLog Analyzer "j_username"跨站脚本漏洞

ManageEngine EventLog Analyzer是安全信息和事件管理软件。 ManageEngine EventLog Analyzer 8.6及其他版本没有正确过滤event/jsecuritycheck 当设置了"jpassword"后的"jusername" GET参数，这可导致在受影响站点用户浏览器会话中执行任意HTML和脚本代码。 0 ManageEngine EventLog Analyzer 8.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Android Fragment Injection vulnerability

Hi, We have recently disclosed a new vulnerability to the Android Security Team. The vulnerability affected many apps, including Settings the one that is found on every Android device, Gmail, Google Now, Dropbox and Evernote. To be more accurate, any App which extended the PreferenceActivity clas...

[Arachni v0.4.6 - Web User Interface v0.4.3] Open Source Web Application Security Scanner Framework

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. Arachni is smart, it trains itself by learning from the HTTP responses it receives during the audit process. Unlike other...

Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection

source: https://www.securityfocus.com/bid/64707/info Command School Student Management System is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery vulnerability 3. A cross-site scripting vulnerability 4. An HTML injection...

[dotDefender] Web Application Security

dotDefender is the market-leading software Web Application Firewall WAF. dotDefender boasts enterprise-class security, advanced integration capabilities, easy maintenance and low total cost of ownership TCO. dotDefender is the perfect choice for protecting your web site and web applications today...

[Watcher] passive Web-security scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

PT-2014-65: Multiple Cross-Site Scripting in InstantCMS

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in InstantCMS. Cross-site scripting in the spellchecker.php file allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's...

PT-2014-68: Multiple SQL Injection in InstantCMS

The specialists of the Positive Research center have detected multiple SQL Injection vulnerabilities in InstantCMS. SQL Injection in the cms.php script allows remote attackers to execute arbitrary SQL commands via a specially crafted request. How to fix Update your software up to the latest...

PT-2014-67: Open Redirect in InstantCMS

The specialists of the Positive Research center have detected an Open Redirect vulnerability in InstantCMS. Open redirect in the set.php script allows remote attackers to control user redirection. This vulnerability can be exploited to conduct a series of attacks against users of the web...

PT-2014-79: Cross-Site Scripting in ShopOS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in ShopOS. Cross-site scripting in the market.php script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fix No...

PT-2014-86: Local File Inclusion in ShopOS

The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in ShopOS. Insufficient validation of user input in the 5.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may result in sensitive...