SQL Injection in Dokeos

High-Tech Bridge Security Research Lab discovered vulnerability in Dokeos, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in Dokeos: CVE-2013-6341 The vulnerability exists due to insufficient validation of "language" HTTP GET parameter passed to "/index.php" script. A...

JReport Cross Site Request Forgery

================================================================================================================================================================ JREPORT Cross Site Request Forgery Vulnerability...

Course Registration Management System - Cross-Site Scripting SQL Injection

Course Registration Management System - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/63435/info Course Registration Management System is prone to multiple cross-site scripting and multiple SQL-injection vulnerabilities because it fails to properly sanitize...

WordPress Theme Area53 - Arbitrary File Upload

WordPress Theme Area53 - Arbitrary File Upload . . . \ \ | / \ \ \ | || / \ / / \ / |/ \ / | / \ / / /| | |/ \ \ \ // \ / / | \ /\ / | \ \ \ / \ //\ |\ | /\ // | /|\ / / / / / / / Exploit Title: WordPress Area53 theme Arbitrary File Upload Vulnerability Author: Byakuya Date:...

PHP Point Of Sale - 'ofc_upload_image.php' Remote Code Execution

source: https://www.securityfocus.com/bid/63219/info PHP Point Of Sale is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in context of the application. Failed exploits may result in denial-of-service conditions. '; $headers =...

Important: Red Hat Security Advisory: commons-fileupload security update

An update for the commons-fileupload component that fixes one security issue is now available from the Red Hat Customer Portal for Red Hat JBoss SOA Platform 4.3.0.GACP05 and 5.3.1 GA. The Red Hat Security Response Team has rated this update as having important security impact. A Common...

eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability

Title: ====== eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability Date: ===== 2013-08-31 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1064 VL-ID: ===== 1064 Common Vulnerability Scoring System: ==================================== 3.8 Introduction:...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Monstra CMS 1.2.0 - 'login' SQL Injection

source: https://www.securityfocus.com/bid/62572/info Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

WordPress Complete Gallery Manager Plugin 3.3.3 - Arbitrary File Upload

Complete Gallery Manager is prone to an arbitrary file upload vulnerability that is located in the /plugins/complete-gallery-manager/frames/ path when processing to upload via the upload-images.php file own malicious context or webshells.The vulnerability allows the attackers to upload files via...

vtiger CRM 5.4.0 SQL Injection

Advisory ID: HTB23168 Product: vtiger CRM Vendor: vtiger Vulnerable Versions: 5.4.0 and probably prior Tested Version: 5.4.0 Vendor Notification: August 7, 2013 Vendor Patch: September 17, 2013 Public Disclosure: September 18, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

DefCamp 2013 - International Hacking and Information Security Conference in Romania

The Fourth Edition of an International Information Security Conference hosted in Romania , The DefCamp 2013 is now open for Call for Papers. Over 300 Security experts, Researchers, and Enthusiasts from Romania and neighboring countries are expected to take part in the event in Bucharest, at the...

DefCamp 2013 - International Hacking and Information Security Conference in Romania

The Fourth Edition of an International Information Security Conference hosted in Romania , The DefCamp 2013 is now open for Call for Papers. Over 300 Security experts, Researchers, and Enthusiasts from Romania and neighboring countries are expected to take part in the event in Bucharest, at the...

MS13-077: Vulnerability in Windows Service Control Manager could allow elevation of privilege: September 10, 2013

Resolves a vulnerability in Windows Service Control Manager that could allow elevation of privilege if an authenticated user is convinced to execute a specially crafted application.INTRODUCTIONMicrosoft has released security bulletin MS13-077. To view the complete security bulletin, go to one of...

[OWASP Broken Web Applications Project VM v1.1] Collection of vulnerable web applications

The Broken Web Applications BWA Project is a collection of vulnerable web applications that is distributed on a Virtual Machine. The Broken Web Applications BWA Project produces a Virtual Machine running a variety of applications with known vulnerabilities for those interested in: Learning about...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

glFusion 1.3.0 SQL Injection

Information -------------------- Name : SQL Injection Vulnerability in glFusion Software : glFusion 1.3.0 and possibly below. Vendor Homepage : http://www.glfusion.org Vulnerability Type : Blind SQL Injection Severity : Critical Researcher : Omar Kurt Advisory Reference : NS-13-009 Description...

Java Code-Signing, Security Prompts Fail with Developers

Why would a software company require developers to sign code, thereby ensuring a modicum of trust—but not security—and then shatter that trust by allowing signed applets to bypass their own application sandbox? Welcome to the world of Oracle and Java, where a once healthy programming language has...

Short Password Reset code vulnerability allows hackers to brute-force many websites

Yesterday we received a vulnerability report in web applications from some unknown Indian Hacker, who explained that how Hackers are hijacking Mobile recharge and Free SMS service related websites. He detailed the loophole in password reset process, that could allow attackers to brute force many...

Pligg CMS 2.0.0rc2 Cross Site Request Forgery

--------------------------------------------------- Exploit Title: Pligg CMS - CSRF Vulnerability Author: DaOne Vendor Homepage: http://pligg.com/ Download link: https://github.com/Pligg/pligg-cms/archive/2.0.0rc2.zip Category: webapps/php Version: 2.0.0rc2 + old versions...