Diferior 8.03 Cross Site Scripting

Vulnerability ID: HTB22721 Reference: http://www.htbridge.ch/advisory/storedxsscrosssitescriptingvulnerabilityindiferior.html Product: Diferior Vendor: Povilas Musteikis http://www.diferior.com/ Vulnerable Version: 8.03 and probably prior versions Vendor Notification: Vulnerability Type: Stored X...

XSS vulnerability in Frog CMS

Vulnerability ID: HTB22684 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfrogcms2.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: XSS Cross...

SmartBox - 'page_id' SQL Injection

source: https://www.securityfocus.com/bid/45101/info SmartBox is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

Web Crawler : Web Application Crawler - New Release

Web Crawler is a open source application that is based on the WebEngine library. WebEngine is the set of tools for performing black-box web-sites testing and other similar tasks. It provides tools means for reception of documents from a web-server, parse HTML pages, their comparisons, search...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Getsimple CMS 2.01 < 2.02 - Administrative Credentials Disclosure

Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548 download svn for 2.02beta: svn...

Drive-By Downloads Still Running Wild

For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better. The attack landscape has shifted in a lot of important ways in the last few years, but none of the changes ha...

Simea CMS - index.php SQL Injection

Simea CMS - index.php SQL Injection source: https://www.securityfocus.com/bid/44878/info Simea CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise t...

NSA: Our Development Methods Are in the Open Now

WASHINGTON–Despite its reputation for secrecy and technical expertise, the National Security Agency doesn’t have a set of secret coding practices or testing methods that magically make their applications and systems bulletproof. In fact, one of the agency’s top technical experts said that virtual...

Woltlab Burning Board 'locator.php' SQL Injection Vulnerability

Woltlab Burning Board is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in t...

Penetration Tester XSSer v1.0 - New Version Download

All of you web application penetration testers, check out this release of XSSer version 1.0! From this release, the author plans to rename XSSer to "The Mosquito". Our first post regarding XSSer can be found here. "XSSer is an open source penetration testing tool that automates the process of...

Joomla Forms Local File Inclusion / Download

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Joomla Component comforms Multiple Vulnerabilities Date: 7-11-2010 Author: Th3 RDX Software Link: n/a Version: n/a Tested on: online Sites category: webapp/Joomla Code : n/a Google Dork :...

JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities

JAF CMS is prone to an shell-command-execution vulnerability and multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit the remote shell-command-execution issue to execute arbitrary shell commands in the context...

CommonSense CMS Sql Injection Vulnerability

Exploit Title: CommonSense CMS Sql Injection Vulnerability --- Platform / Tested on: Win/Linux --- category: webapps/0day --- Code : https://site/article.php?articleid=SQL --- Dork : "Powered by CommonSense CMS" --- Found this article interesting? Follow us on Twitter  and LinkedIn to read more...

XSS in Textpattern CMS

Vulnerability ID: HTB22672 Reference: http://www.htbridge.ch/advisory/xssintextpatterncms.html Product: Textpattern CMS Vendor: Team Textpattern http://textpattern.com/ Vulnerable Version: 4.2.0 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by...

LES PACKS - 'ID' SQL Injection

source: https://www.securityfocus.com/bid/44457/info LES PACKS is prone to an SQL-injection vulnerability. An attacker can exploit this SQL-injection issue to carry out unauthorized actions on the underlying database, which may compromise the application and aid in further attacks...

sNews CMS - Multiple Cross-Site Scripting Vulnerabilities

Vulnerability ID: HTB22638 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsnews1.html Product: sNews Vendor: sNews Team tp://www.snewscms.com/ Vulnerable Version: 1.7 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability &#40;CVE-2010-2750&#41;

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...

Collabtive 0.65 - Multiple Vulnerabilities

ANATOLIA SECURITY ADVISORY ------------------------------------ ADVISORY INFO + Title: Collabtive Multiple Vulnerabilities + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt + Advisory ID: 2010-003 + Version: 0.65 + Date: 12/10/2010 + Impact: Gaining Administrative Privileges...

Site2Nite Auto E-Manager SQL Injection

================================================== Auto e-Manager = SQL Injection Vulnerability ================================================== My + Author : KnocKout Contact : [email protected] + Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB H4X0RE SECURITY PROJECT Software info Web App. :...