WordPress Easy Webinar Plugin - Blind SQL Injection

Easy Webinar plugin is prone to a Blind SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WHMCompleteSolution (WHMCS) 4.5.2 - googlecheckout.php SQL Injection

WHMCompleteSolution WHMCS 4.5.2 - googlecheckout.php SQL Injection source: https://www.securityfocus.com/bid/56173/info WHMCS WHM Complete Solution is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting...

World Health Organization website hacked by NullCrew

A well known hacking group "Nullcrew" once again most active hacking group right now. Dumping database from number of websites daily. Their latest target was World Health Organization WHO website. Well, World Health Organization website who.int need treatment now, because their admin panel...

CMSMini 0.2.2 Cross Site Scripting

Information -------------------- Name : XSS Vulnerabilities in CMSMini Software : CMSMini 0.2.2 and possibly below. Vendor Homepage : http://sourceforge.net/projects/cmsmini/ Vulnerability Type : Cross-Site Scripting Severity : Critical Researcher : Canberk Bolat Advisory Reference : NS-12-012...

How to Minimize Web Application Security Risk !

With Web applications remaining a popular target for attackers, Web app security sometimes seems like a digital version of the "Good, the Bad and the Ugly." Vulnerabilities in web applications are now the largest vector of enterprise security attacks. Web application security is much more...

Cisco WebEx Recording Format Player atas32.dll Memory Corruption (CVE-2012-3939)

A remote code execution vulnerability has been reported in Cisco WebEx Recording Format WRF Player. The vulnerability is due to a memory corruption when the WRF player handles specially crafted WRF files. A remote attacker can exploit this issue by enticing an affected user to open a specially...

Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities

Title: ====== Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities Date: ===== 2012-09-06 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=557 VL-ID: ===== 557 Common Vulnerability Scoring System: ==================================== 5 Introduction: ============= T...

CVE-2011-5203

CVE-2011-5203 concerns a SQL injection in Akiva WebBoard’s WB/Default.asp before version 8 SR 1, exploitable remotely via the name parameter. Affected component is WebBoard’s server-side script; underlying issue is improper input handling enabling arbitrary SQL execution. NVD reports a CVSS v2 ba...

CVE-2012-5298

CVE-2012-5298 concerns Mavili Guestbook (released November 2007). The vulnerability arises because guestbook.mdb is stored under the web root with insufficient access control, allowing remote attackers to read the database by direct request. The impact is exposure of guestbook data; exploitation ...

Diy21 CMS v3.10 (product.php) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Diy21 CMS v3.10 product.php SQL Injection Vulnerability Date: 03-10-2012 Author: Mouh Marvel-Dz Facebook : http://www.facebook.com/mouh.marvel Category: webapps Google dork: intext:"Powered by: Diy21 CMS v3.10"...

WordPress Core 3.4.2 - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/55660/info WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user...

YCommerce - Multiple SQL Injections

YCommerce - Multiple SQL Injections source: https://www.securityfocus.com/bid/55653/info YCommerce is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacke...

Disconnect Between Application Development and Security Getting Wider

There is a widening gulf between application developers and security decision makers inside the enterprise, and it’s starting to cost companies serious money. Sure there’s been lots of talk about the need for better static and dynamic web application testing tools and the need for a formalized...

FBDj - id SQL Injection

FBDj - id SQL Injection source: https://www.securityfocus.com/bid/55504/info FBDj is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application,...

Post non-book information management system SQL injection-vulnerability warning-the black bar safety net

Injection point: http://target/asearch.do?status=showpage&LanguageType=1 Database: proone Table:ACCOUNT Fields:ACCID,is to the accname,PASSWORD,QQ,EMAIL,TELEPHONE, etc. !...

Cannonbolt Portfolio Manager 1.0 Cross Site Scripting / SQL Injection

Exploit for php platform in category web applications Cannonbolt Portfolio Manager v1.0 Stored XSS and SQL Injection Vulnerabilities Vendor: IWCn Systems Inc. Product web page: http://www.iwcn.ws Affected version: 1.0 Summary: Cannonbolt Portfolio Manager is a sleek and AJAX based PHP script to...

GNU glibc - 'strcoll()' Routine Integer Overflow

// source: https://www.securityfocus.com/bid/55462/info GNU glibc is prone to a remote integer-overflow vulnerability which leads to buffer overflow vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of a user running an application that uses the...

Sciretech (Multiple Products) - Multiple SQL Injections

source: https://www.securityfocus.com/bid/55390/info Sciretech Multimedia Manager and Sciretech File Manager are prone to multiple SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...

Joomla! Component Spider Calendar - SQL Injection

Joomla! Component Spider Calendar - SQL Injection Exploit Title: Joomla spider calendar lite Remote Exploit dork: inurl:comspidercalendar Date: 29-08-2012 Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R site: http://poisonsecurity.wordpress.com/ Vendor:...

Winlog Lite SCADA HMI system - Overwrite (SEH)

Winlog Lite SCADA HMI system - Overwrite SEH Vuln Title: Winlog Lite SCADA HMI system SEH 0verwrite Vulnerability Author: FaryadR a.k.a Ciph3r tested on : winXp sp3 and Winlog Lite 2.06.17 Version Twitter : https://twitter.com/faryadR Mail : [email protected] Website : http://0c0c0c0c.com...