Joomla! 'Video Gallery' Component Multiple Vulnerabilities

This host is running Joomla! Video Gallery component and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodjoomlacomvideogallerymultvuln.nasl 5956 2017-04-14 09:02:12Z teissa $ Joomla! 'Video Gallery' Component Multiple Vulnerabilities Authors: Rachana Shetty Copyright:...

A CISO's Guide To Application Security – Part 2: The Growing Threat to Applications

Editor’s Note: This post is the second in a multi-part series on Application Security, or “AppSec” prepared by our friends over at application testing firm Veracode. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a da...

exponentcms 2.0.5 - Multiple Vulnerabilities

Information -------------------- Name : XSS and Blind SQL Injection Vulnerabilities in ExponentCMS Software : ExponentCMS 2.0.5 and possibly below. Vendor Homepage : http://www.exponentcms.org Vulnerability Type : Cross-Site Scripting and SQL Injection Severity : Critical Researcher : Onur Yılmaz...

Oracle Enterprise Manager SQL injection Vulnerability

Exploit for jsp platform in category web applications -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AppSecInc Team SHATTER Security Advisory SQL Injection in Oracle Enterprise Manager compareWizFirstConfig web page. Risk Level: High Affected versions: Oracle Enterprise Manager Database Control...

Oracle Enterprise Manager compareWizFirstConfig SQL injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 AppSecInc Team SHATTER Security Advisory SQL Injection in Oracle Enterprise Manager compareWizFirstConfig web page. Risk Level: High Affected versions: Oracle Enterprise Manager Database Control 11.1.0.7, 11.2.0.2 and previous patchsets Oracle...

A simple file extension authentication bypass techniques-vulnerability warning-the black bar safety net

Mining the web application 0day the most effective and most direct way is directly from the file operation function to start with, my personal preference first took a fancy to pass the class code, The this article to a simple tips. Of course skill is not entirely original, is by learning someone...

A CISO's Guide To Application Security – Part 1: Defining AppSec

Editor’s Note: This post is the first in a multi-part series on Application Security, or “AppSec” prepared by our friends over at application testing firm Veracode. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a dat...

Cross-site scripting vulnerability in Invision Power Board version 3.2.3

Information -------------------- Name : Cross-site scripting vulnerability in Invision Power Board version 3.2.3 Software : Invision Power Board version 3.2.3 Vendor Homepage : http://www.invisionpower.com Vulnerability Type : Cross-site scripting Severity : High Researcher : Vasil A. [email protected]...

osCMax 2.5 - '/admin/login.php?Username' SQL Injection

source: https://www.securityfocus.com/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

Animus Twitter Tool CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Animus Twitter Tool CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/animus-twitter-tool/29367/ Category:: webapps Demo : http://www.animusprogramming.com/anitwtr/anitwtr.php Greetz: Inj3ct0r...

FAQ module for phpFaber CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: FAQ module for phpFaber CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/faq-module-for-phpfaber-cms/19826/ Category:: webapps Demo : http://demo.phpfaber.com/cms1/cmsadmin Greetz: Inj3ct0r Explo...

e107 1.0 - 'view' SQL Injection

source: https://www.securityfocus.com/bid/52821/info e107 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or...

Knowledge Base Builder CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Knowledge Base Builder CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/knowledge-base-builder-by-stivasoft/31827/ Category:: webapps Demo : http://www.phpjabbers.com/demo/kbb10/ Greetz: Inj3ct0r...

NextBBS 0.6 - ajaxserver.php Multiple SQL Injections

NextBBS 0.6 - ajaxserver.php Multiple SQL Injections source: https://www.securityfocus.com/bid/52728/info NextBBS is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and an authentication-bypass vulnerability. Exploiting these vulnerabilities could allow an...

SEO PHP Directory Software CSRF

Exploit for php platform in category web applications Exploit Title: SEO PHP Directory Software CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/php-directory-software-seo/32316/ Category:: webapps Demo : http://demos1.softbiz.com/scripts/seodirectory/admin/ Greet...

PHP Gift Registry 1.5.5 SQL Injection

Exploit Title: PHP Gift Registry 1.5.5 SQL Injection Date: 02/22/12 Author: G13 Software Link: https://sourceforge.net/projects/phpgiftreg/ Version: 1.5.5 Category: webapps php Vulnerability The userid parameter in the users.php file is vulnerable to SQL Injection. A user must be signed in to...

ManageEngine DeviceExpert 5.6 Java Server Directory Traversal

Exploit for jsp platform in category web applications ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Database Backup / auth-conf.xml Disclosure Exploit product homepage: http://www.manageengine.com/products/device-expert/ file...

Invision Power Board 3.2.3 Cross Site Scripting

Name : Cross-site scripting vulnerability in Invision Power Board version 3.2.3 Software : Invision Power Board version 3.2.3 Vendor Homepage : http://www.invisionpower.com Vulnerability Type : Cross-site scripting Researcher : Vasil A. [email protected] Description -------------------- Invision Power...

Advanced POWER PACKED Freelancers CSRF

Exploit for php platform in category web applications Exploit Title: Advanced POWER PACKED Freelancers CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/advanced-power-packed-freelancers-script-php/22749/ Category:: webapps Demo :...

F5 FirePass 7.0 - SQL Injection

F5 FirePass 7.0 - SQL Injection source: https://www.securityfocus.com/bid/52653/info FirePass is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the...